• 1 Post
  • 7 Comments
Joined 1 year ago
cake
Cake day: June 17th, 2023

help-circle







  • liori@lemm.eetoLinux@sopuli.xyzMOSH - security?
    link
    fedilink
    arrow-up
    2
    ·
    edit-2
    1 year ago

    Mosh is not more secure than SSH: it uses SSH to initiate connections, so this is the upper bound.¹ Mosh’s UDP protocol has not been given the same security attention as SSH’s, though. As such, I’m willing to use it over the open internet for private stuff, but not for business use cases.

    ¹ I know mosh authors write «In one concrete respect, the Mosh protocol is more secure than SSH’s: SSH relies on unauthenticated TCP to carry the contents of the secure stream.», but this refers to the UDP stream after the connection is initiated. If there is a security hole in SSH, it’s pretty likely the attacker could take advantage of it during the connection initiation process. Mosh authors do acknowledge this in the subsequent paragraph: «However, in typical usage, Mosh relies on SSH to exchange keys at the beginning of a session, so Mosh will inherit the weaknesses of SSH—at least insofar as they affect the brief SSH session that is used to set up a long-running Mosh session.»