[Cryptography] Why aren’t we using SSH for everything?

[Eric Mill]

On Sat, Jan 3, 2015 at 11:48 PM, Christoph Anton Mitterer <
calestyo at scientia.net> wrote:

> On Sat, 2015-01-03 at 14:53 -0800, Tony Arcieri wrote:
> > SSH has a generally weaker model (TOFU) than at least a privately
> > maintained X.509 hierarchy (the answer for a stronger/more agile
> > approach on the SSH side is X.509-like SSH CAs). Likewise, TOFU
> > handles key agility poorly:
>
> No one forces users to blindly trust a remote host key on first
> encountering it, that's why there are fingerprints and people should
> validate those - if people are stupid and don't validate them, well then
> you can't help such folks.
>

This is exactly why we have TLS used by the public, and SSH used by power
users. Basic security for the web means not having to verify fingerprints
for every service or person you want to interact with.


>
> And legacy protocols? LOL? I don't think that either of the two will get
> away soon.
>

I hope we're not still stuck throwing bandaids on 1990s ideas in the 2030s.

-- Eric


> Cheers,
> Chris.
>
> _______________________________________________
> The cryptography mailing list
> cryptography at metzdowd.com
> http://www.metzdowd.com/mailman/listinfo/cryptography
>



-- 
konklone.com | @konklone <https://twitter.com/konklone>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.metzdowd.com/pipermail/cryptography/attachments/20150104/e7caccec/attachment.html>