full-disclosure - HTTP AUTH BASIC monowall.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon Mar 13 20:04:08 2006
From: requiem at praetor.org (Jeremy Bishop)
Subject: HTTP AUTH BASIC monowall.

On Monday 13 March 2006 11:56, Matthijs van Otterdijk wrote:
> except for that SSH uses RSA, which uses a public and private key. If
> the password is encrypted during the transfer to the site, and can
> only get decrypted there, then it can't possibly be sniffed with some
> computer inbetween, can it?

As Tim mentioned, the question isn't about the information getting to a 
site securely, it's about whether that site is the correct one and not 
an impostor.

(I think the original poster was referring to SSL, not SSH, but that is 
really immaterial to the question.)

Jeremy

-- 
The universe does not have laws -- it has habits, and habits can
be broken.
                        -- BSD fortune file