Tag Info

Hot answers tagged

7

If you are Windows OS, there is a way to use torify your SSH using Putty client. Here are the configurations you need to set: If you are using a Linux distribution, it depends on which one you are using. For example, if you are runnin Ubuntu you can (How to use SSH with Tor?): Add the following block to the top of your ~/.ssh/config file. Host * ...


7

They can. In order to establish a secure HTTPS connection a handshake must happen between you, (the client, i.e. your browser or any other application) and the server. Any data sent within the handshake is not encrypted. About the risks, it's a broad topic to discuss. The plain information that you are connecting to some public server (Facebook, Gmail, ...


6

Yes. This is called "Traffic Analysis". Broadly speaking, the useful information that can be obtained is who you're talking to, and when. So if you're ssh'ed into a server and the packets look like someone typing, it then looks like you're up and actively engaged in some activity with that server. The volume of the data going back and forth can be ...


4

As Naftuli Tzvi Kay stated a well worn solution is using a hardware device to manage your keys. Some alternatives for a software solution include: Making your private keys only readable by root / sudo Encrypting your private key with a password, so at least it will be non trivial for the attacker to crack it if they do steal Storing them in an encrypted ...


4

If such computation is a concern for you (for instance if you have a lot of successive connections), depending on your usage you may be interested in SSH ControlMaster Session feature. It allows SSH to multiplex several sessions inside one TCP connection, so the handshake is realised only once then each new session can just reuse the already established ...


3

First of all, the answer depends on your SSH client. Let's assume you are using latest OpenSSH client. The SSH2 protocol starts like this: Client -> Server: Initiate connection, send client software version + SSH version Server -> Client: Server software version and SSH version Client -> Server: Client supported algorhitms Server -> Client: ...


3

No, this is correct, you are putting PPP packets into your SSH connection. The idea of a VPN is that you are tunnelling, which basically means that you have an SSH connection (a tunnel) that looks like PPP when you are sending something into it. Thus, if you send a request through your tunnel with a protocol like HTTPS, your packet on the wire will look ...


2

Sure, they can. A proper encryption is supposed only to hide the content, but is not expected to hide: parties involved in the communication size of data exchanged timing of packets (anything else) Moreover, some data may be leaked from the initial handshake. For example, HTTPS with SNI leaks the domain you are connecting to in plaintext even if the ...


2

Using unique keys would be better from a security standpoint. Create a unique key for each server and distribute it using the copy-ssh-id command. Related: http://askubuntu.com/questions/4830/easiest-way-to-copy-ssh-keys-to-another-machine


2

Alternatively, you might consider the JuiceSSH client. It stores your keys in its private app directory. In addition, it encrypts its storage so even jailbroken phones offer some level of protection. Sources: - @JuiceSSH: "External storage won't work as keys are imported into the internal JuiceSSH database". - @JuiceSSH: "They [ssh keys] are stored in an ...


2

The computation is not that heavy regarding the security advantages because if the server is spoofed or compromised, the attacker can not get the private key (and pwd); at best he can the signature which can not be very interesting for him because a signature cannot be re-used: that is why it is a worth while to perform some calculations for the sake of ...


2

Both SSH and HTTPS (relying on SSL or TLS) use encryption, but are based on an established TCP/IP existing connection. This means that even if the content is opaque, all TCP/IP information are in clear and available to someone sniffing your network. TCP/IP information includes IP address of each peer, port numbers used. This gives a good hint about protocol ...


1

To understand this vulnerability you need to understand the way how the X11 forwarding over ssh works and what part is vulnerable. There is basic image: [ ssh client ] --> [ ssh server ] [ x11 server ] [ x11 client ] The one who is vulnerable is the part with ssh-client and x11 server if connecting to malicious ssh server. If there is no ...


1

It's best to generate a public and private key-pair for each host, and copy all public keys to one server. When using public key cryptography the goal is to keep the private key secret. Option number 2 would mean that all hosts could impersonate the other hosts. While this might not seem like a bad idea for data transfers, SSH keys are also used for ...



Only top voted, non community-wiki answers of a minimum length are eligible