|
North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: Wireless insecurity at NANOG meetings
On Sun, Sep 22, 2002 at 01:11:07PM +0200, Iljitsch van Beijnum wrote: > > There are also people ssh'ing to personal and corporate machines from > > the terminal room where the root password is given out or easily > > available. > > Are you saying people shouldn't SSH? I've seen far too many people get into trouble because they have some flawed thinking that "ssh == always secure", even against compromises of one of the endpoints. If root is available, a reasonable person should ASSUME that some bored individual (like Bandy Rush) has taken 30 seconds and recompiled the ssh binaries with a password logger. Heck even if it isn't available, you couldn't pay me enough money to trust public access terminals to log into something which doesn't use a one-time password. -- Richard A Steenbergen <[email protected]> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)
|