Conversation

Notices

1. Embed this notice
   SaraMG (saramg@fosstodon.org)'s status on Thursday, 16-Nov-2023 05:05:11 JST SaraMG

   in reply to

   • Erik L. Arneson :emacs:

   @pymander """Of the roughly 1 billion RSA signatures, about one in a million exposed the private key of the host."""

   Still a real danger, but that much is at least a little reassuring.

   As for mitigation.... change your hostkey to ECDSA or similar? Granted, that's just as disruptive, but it's disruptive in a way that's communicable and plannable.

   • Embed this notice
     Erik L. Arneson :emacs: (pymander@fosstodon.org)'s status on Thursday, 16-Nov-2023 05:05:14 JST Erik L. Arneson :emacs:

     Well, yikes. Have y'all heard of this new #ssh #vulnerability? What are we supposed to do to mitigate it? Are there safe ways to use RSA keys?

     https://www.schneier.com/blog/archives/2023/11/new-ssh-vulnerability.html