> What exactly do you think "untrusted" means in the phrase "untrusted
> host"?
That anything and everything will be captured and logged in plain
text. That's what _I_ consider "untrusted". Everything including
the login credentials, but they're a one-time thing. Right? Is
that not the case?
What am I missing here? This is a very simple question... In the
following sequence, where do I go wrong?
1) Log into system via ssh skey, which is a one-time auth method
2) Type 'sudo farfegnugen blahblah yadda'
3) Log out
As I understand things, the attackers now have my one-time auth
info, which won't work again. Right?
They also know I typed 'sudo fargegnugen blahblah yadda'. Neato.
And they saw me log out. So, they have an auth string that will
not work, a command that won't work unless they can log in as
me, and they now know how to log out.
I absolutely admit that I'm an idiot when it comes to this. I
would just appreciate knowing the flaws in this particular plan.
Benny
--
"Now, that next spring you find in your garage a creature that
looks like a cross-bred badger and anaconda. A badgerconda."
-- bash.org
