Fakin out ssh

neo · 04-29-2005, 03:47 PM

Telnet sends unecrypted passwords, correct?

SSH sends everything encrypted. What stops someone from sniffing the encrypted password and then editing their ssh client to send out the encrpyted password? They wouldn't need the real password they could just send the encrypted hash direct and fake out ssh.

neo · 04-29-2005, 03:53 PM

I was thinking either it time stamps the password and encryptes both time stamp and password producing a different hash everytime or it uses a different key everytime.

So which one is it?

capnpayne · 04-29-2005, 04:08 PM

http://openssh.org

doesn't work like that at all

April · 04-29-2005, 08:36 PM

Plus, a good, secured SSH server will use PublicKeyAuthentication anyways. Password authentication can be disabled entirely.

MS3FGX · 04-30-2005, 04:12 AM

The password can very easily be sniffed from a SSH v1 connection too, by the way.