Re: [ProgSoc] https:// a security risk?

[Chris Mewett <bemused@nospam.progsoc.uts.edu.au>]

On Sun, 18 Feb 2001, Christian Kent wrote:

<snip>
> Same with SSH, but I guess that's down to ignorance.  So is it also

Are you kidding about SSH? SSH is a huge risk when you can't trust your
users (which seems often):

1. You can't state inspect an encrypted session, so you're letting any TCP
22 out.
2. The protocol allows port forwardings in either direction, exposing any
internal resources the user can access.


Don't get me wrong, SSH has its uses, but its certainly not a protocol
that makes sense in any sort of "default allow" situation.

--chris.

<snip>

-
You are subscribed to the progsoc mailing list. To unsubscribe, send a
message containing "unsubscribe" to progsoc-request@nospam.progsoc.uts.edu.au.
If you are having trouble, ask owner-progsoc@nospam.progsoc.uts.edu.au for help.