Re: [gentoo-dev] disabling password authentication on dev.gentoo.org

[Arthur Britto]

On Tue, 2003-12-02 at 09:33, Alex Veber wrote:
> Can you please explain whats wrong with using my password?

Never use your password on a machine you do not fully control:
  Someone may have installed a hardware or software keystroke logger.

Keystroke loggers are available externally and built into keyboards:
  http://www.keyghost.com/

>From an unsecure host, you can use a one time password to access your
secure machines:
  http://forums.gentoo.org/viewtopic.php?t=103232

However, the paranoid must consider:
 1) Anything communicated over the link may be recorded.

The truly paranoid must also consider:
 1) Once communication is established the accessing machine may insert
commands and filter results presented to you.
 2) You must ensure you really logout.  Just because it looks like you
logged out does not mean you were logged out.

-Arthur



--
gentoo-dev@g.o mailing list