How to verify if SSH Client is not recording my login information?

Question

there are lots of SSH Clients one can use with Android, for example JuiceSSH client, so i have a security concern, that is, how can i know or verify, that this app is not recording my credentials to when i authenticate to my server?

Answer 1

It is hard to verify that your login information is not being transmitted to third parties. A malicious application could choose to share your credentials directly (or at a later moment) with an attacker (possibly in encrypted form).

Possible solutions or mitigations:

• Use an opensource SSH client such as ConnectBot, the source code is available so you could audit it or build it yourself.
• Use SSH keys instead of password-based authentication. While an attacker can also copy the private SSH key to a third party, revoking a SSH key should be easier than changing and remembering a new password.
• Trust on the (number of) users and reviews of the product, check the background of the author.

Answer 2

I highly recommend reading Reflections on Trusting trust a short speech By Ken Tompson It shows just how difficult it is to verify nothing malicious is going on in a program you are running. You must trust the author of the program, and of the compiler and the compiler compiler and the OS and the BIOS etc. etc.

You can minimize the risk, use a well reviewed program, possibly review it yourself. Though some issues may be hard to find even if present in the source code: http://www.underhanded-c.org/) You can try to monitor behavior of the application, for specific suspicious behavior, like connecting to some other server you didn't ask it to, but there are techniques for ex-filtrating data which are hard to detect, especially if they are novel. Most of us focus on using well known open source software fetched from a trusted source and signed by a trusted source. Extra measures are possible though usually not worth it.