@marcan42 so lots of barking for nothing much?
Proper analysis of the OpenSSH vuln: https://www.qualys.com/2016/01/14/cve-2016-0777-cve-2016-0778/openssh-cve-2016-0777-cve-2016-0778.txt … TL;DR agent keys safe, non-agent keys only leak encrypted, MITM not possible.
-
-
-
@flameeyes Pretty much. If you see "connection suspended, press return to resume", hit ^C and the atack is prevented. It even warns you. - Show replies
New conversation -
-
-
@luisbruno@marcan42 it could have waited for embargo rather than having everybody scramble.Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
@luisbruno@marcan42 I don't know. The statements and Poc up to now seem clear that it's a very slim surface. I find it hero syndrome.Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
@luisbruno@marcan42@travisgoodspeed yes — it's still a very *slim* surface, IMHO not big enough to breach embargo. -
@luisbruno@marcan42@travisgoodspeed it has an explicit warning that something odd is happening, requires keyfiles *and* key is encrypted.
End of conversation
New conversation -
-
-
@luisbruno@marcan42@travisgoodspeed an already-compromised bad server. If you have ForwardAgent on, it's worse.Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
@luisbruno@flameeyes@travisgoodspeed How many people seriously use keys without ssh-agent day to day?Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
@luisbruno@flameeyes But... we do have further info. Qualys found this and Qualys published the detailed report. What's missing?Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
@luisbruno Well, the onus is on him to explain... but lacking an indication that he knows something we don't, I tend to side with@flameeyes -
@marcan42@luisbruno see, I don't trust people for their name, but for their actions, to me this was a hero-complex action.
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.