What is Digg?Sponsored by Best Buy
Meet Keith: Best Buy Employee and Possible Singing Sensation. view!
www.youtube.com/bestbuy - One employee proves he has the chops and the passion to star in Best Buy’s holiday campaign.
7 Comments
- Stradenko, on 10/12/2007, -1/+5And to qualify my response, Schestowitz, the reason your comment doesn't apply is because secret keys are stored on clients and never given to servers, so doing any checking is probably out of the question.
- Stradenko, on 10/12/2007, -1/+3@schestowitz
"Blank passphrase" is what I think nowen meant. When you're using key-based authentication, as often happens, your secret key can (and should) be encrypted using a pass-phrase. If this is blank, however, anyone who gets your secret key can easily pretend to be you.
Additionally, the article is inaccurate.
False: * There is no way to control which users have public key authorization
True: * There is no way to enforce passphrase complexity (or even be sure that one is being used)
True enough, but probably misleading: * There is no way to expire a public key - schestowitz, on 10/12/2007, -2/+3Choice of password is a weak link, but with cross-dictionary checks and minimal length and forcing of upper/lower/digit/symbol-case mixture, all should be fine. Blaming SSH for breaches where the password is blank is like blaming a bank, rather than the teller/banker for being negligent and leaving the safe door open.
- nowen, on 10/12/2007, -2/+3SSH is great software, but was not designed to pass audits. Plus, you never know is someone has used a blank password.
- schestowitz, on 10/12/2007, -1/+1Thanks for the clarification, guys. You're way beyond me on security considerations. :-)
- BG5954729, on 10/12/2007, -4/+3I've been using WiKID for the past few weeks and have found it to be a fantastic alternative to 2-factor auth with the One-time password tokens. Within a length of a day I had my SSH gateway, OpenVPN, SSL Extranet, and PHP engine set up and operational using WiKID. Definitely worth a look.
- undersky, on 10/12/2007, -5/+3what an incredibly vernacular article! how did it get to the front page? no idea what the heck the description is talking about...
/ignorant
The Digg Toolbar for Firefox lets you Digg, submit content, and keep track of Digg even when you're not on the Digg site. Download the official 
© Digg Inc. 2009
— Content created and posted by Digg users is