Linked Questions

5 votes
1 answer

How does SSH know which public key to use from authorized_keys? [duplicate]

When an SSH client connects to an SSH server using public key authentication, the server encrypts a message using a public key from authorized_keys, and the client must prove it can decrypt the ...
aaa90210's user avatar
  • 185
3 votes
3 answers

How do SSH keys work? [duplicate]

I'm just looking for a simplified explanation of the mechanics of SSH authorization. Basically, what makes it better then a really long password? And how does the public key play into things? I ...
amflare's user avatar
  • 139
1 vote
2 answers

What prevents someone from spoofing their public key when trying to establish an SSH connection? [duplicate]

Recently I've been trying to learn the mechanisms behind SSH keys but I came across this question that I haven't been able to find an answer to (I haven't figured out how to word my question such that ...
temp8163490183783's user avatar
1 vote
2 answers

Public key or Private key [duplicate]

I've reading about asymmetric cryptography and I know that the concept is to keep the private key to yourself and distribute the public key. But recently I accessed a remote server using SSH with a ....
7_R3X's user avatar
  • 656
-1 votes
1 answer

How exactly is RSA used in SSH [duplicate]

I can find oodles of websites that tell me the server retains the public key and the client retains the private key. But nothing on how the client authenticates to the server and - perhaps - how the ...
Beginner's user avatar
8 votes
2 answers

ssh public/private key pair

I am having problems understanding how ssh really works. I know it uses a public key cryptography to encrypt messages. However, I can ssh to a server without first generating a public/private key pair ...
user avatar
14 votes
2 answers

How to authenticate in a website with public/private keys?

I've been reading how the SSH public/private key works and realized how handy they are (taking the secure out of the equation). And started to wonder why websites do not implement the same thing? ...
Aquiles Carattino's user avatar
2 votes
4 answers

Why don't bigger companies buy similar domains to their main domain to prevent typosquatting?

One big threat out there is typosquat domains. For example instead of: some malicious actor will register the domain and set up his fake steam login. Why do ...
birdd's user avatar
  • 41
7 votes
2 answers

Risk in connecting wrong ssh host?

I've a ssh host key login setup in a remote server, for some reason, the DNS of that host is mapped to another server. So assume the mistaken host cannot be trusted, should I change my key?
Ryan's user avatar
  • 497
10 votes
3 answers

Is piping a `ssh-agent` signed message as a password secure?

There's an encrypted filesystem on a server I ssh into using public key authentication. Since a forwarded ssh-agent can deterministically sign a message (see also the ssh-agent protocol section 2.6.2),...
Tobias Kienzler's user avatar
1 vote
2 answers

How does the public key get authenticated during an ssh session

When using SSH, my private key is stored on my computer safely and my public key is given to the other party I wish to communicate with. I understand that the two keys are mathematically related, and ...
Engineer999's user avatar
1 vote
1 answer

Does a password-derived public key authentication improve security over pure password-based authentication?

Despite best efforts it is pretty clear that most users reuse their credentials, especially for what they consider non-critical sites such as forums. While TFA does mitigate the potential damage of ...
Tobias Kienzler's user avatar
0 votes
0 answers

How do you set private keys in putty enmasse in Windows?

In line with this question...if you have a large number of hosts, and a large number of users who service these hosts, how do you set the private keys for these hosts enmasse across the users who ...
leeand00's user avatar
  • 1,441