Date: Wed, 11 Feb 2009 16:12:30 +0100 From: Daniel Roethlisberger <daniel@roe.ch> To: Dag-Erling =?iso-8859-1?Q?Sm=F8rgrav?= <des@des.no> Cc: Jason Stone <freebsd-security@dfmm.org>, Lyndon Nerenberg <lyndon@orthanc.ca>, freebsd-security@freebsd.org Subject: Re: OPIE considered insecure Message-ID: <20090211151230.GA89737@hobbes.ustdmz.roe.ch> In-Reply-To: <86skmlm6aa.fsf@ds4.des.no> References: <200902090957.27318.mail@maxlor.com> <20090209170550.GA60223@hobbes.ustdmz.roe.ch> <alpine.BSF.2.00.0902091246280.61088@mm.orthanc.ca> <20090209134738.G15166@treehorn.dfmm.org> <86eiy5nqjz.fsf@ds4.des.no> <20090211122200.GA86644@hobbes.ustdmz.roe.ch> <86skmlm6aa.fsf@ds4.des.no>
next in thread | previous in thread | raw e-mail | index | archive | help
Dag-Erling Smørgrav <des@des.no> 2009-02-11: > Daniel Roethlisberger <daniel@roe.ch> writes: > > Your statement is of course correct, logging in from > > untrusted machines can never be secure. However, OPIE still > > raises the bar on the required capabilities for an attack > > (active, real-time attack versus passive keylogging / data > > dumping). > > This conversation reminds me of a flipchart outside the > terminal room at an early BSDCon, with a list of passwords > sniffed from the network and something like "if your password > is listed below, you should consider using SSH" :) :-) The technical "wrong" or "right" is just one aspect of security. Security is also about risk management; elimination being only one possible strategy for adequately dealing with risk. -- Daniel Roethlisberger http://daniel.roe.ch/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20090211151230.GA89737>