Gregory's Server@JessTheUnstill @c0dec0dec0de @colin_mcmillen @bagder TBF using symmetric encryption/hashing it's hard to avoid either storing or transmitting the credentials in the clear. To avoid both you need to use asymmetric (public-key) encryption and only transmit nonces (what hardware tokens do with certificate-based authentication).
|
4 comments
 @c0dec0dec0de @JessTheUnstill @tknarr @bagder my printer self-signs a cert. That's better than clear text even if there's the browser warning.  @colin_mcmillen |
That's not how that works.
When we talk about exchanging credentials in the clear, we're talking stuff like telnet where a MitM can just dump your password via Wireshark. An ssh connection sets up a secure tunnel between the systems, and then compares cryptographic hashes. The plain text password never is stored on disk anywhere, just the one way salted hash of the password.
https://www.digitalocean.com/community/tutorials/understanding-the-ssh-encryption-and-connection-process
@tknarr
@c0dec0dec0de @colin_mcmillen @bagder
That's not how that works.
When we talk about exchanging credentials in the clear, we're talking stuff like telnet where a MitM can just dump your password via Wireshark. An ssh connection sets up a secure tunnel between the systems, and then compares cryptographic hashes. The plain text password never is stored on disk anywhere, just the one way salted hash of the password.