Date: Wed, 11 Feb 2009 14:50:37 +0100 From: =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav?= <des@des.no> To: Jason Stone <freebsd-security@dfmm.org> Cc: freebsd-security@freebsd.org, Lyndon Nerenberg <lyndon@orthanc.ca> Subject: Re: OPIE considered insecure Message-ID: <86skmlm6aa.fsf@ds4.des.no> In-Reply-To: <20090211122200.GA86644@hobbes.ustdmz.roe.ch> (Daniel Roethlisberger's message of "Wed, 11 Feb 2009 13:22:00 %2B0100") References: <200902090957.27318.mail@maxlor.com> <20090209170550.GA60223@hobbes.ustdmz.roe.ch> <alpine.BSF.2.00.0902091246280.61088@mm.orthanc.ca> <20090209134738.G15166@treehorn.dfmm.org> <86eiy5nqjz.fsf@ds4.des.no> <20090211122200.GA86644@hobbes.ustdmz.roe.ch>
next in thread | previous in thread | raw e-mail | index | archive | help
Daniel Roethlisberger <daniel@roe.ch> writes: > Your statement is of course correct, logging in from untrusted > machines can never be secure. However, OPIE still raises the bar > on the required capabilities for an attack (active, real-time > attack versus passive keylogging / data dumping). This conversation reminds me of a flipchart outside the terminal room at an early BSDCon, with a list of passwords sniffed from the network and something like "if your password is listed below, you should consider using SSH" :) DES --=20 Dag-Erling Sm=C3=B8rgrav - des@des.no
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?86skmlm6aa.fsf>