On: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

[amluto]

Server certs are a different issue. If OpenSSH, by default, sent SHA256(logged in user’s password) to the server, even after verifying the cert, it would get laughed out of the toolbox of security-conscious users.