Comment by michaelt
7 hours ago
> Not only was it detected immediately thanks to SSH printing that huge banner on MITM attacks
The thing is, that only helps Tor users who are happy for their PC to contain evidence of what they were doing over Tor (such as a known hosts file listing).
If your security requirements are so high your PC contains no evidence whatsoever of what you were doing over Tor, you wouldn't get the banner.
This is one of the rare use cases where the users should be identifying the servers they are connecting to. If your work is that spooky then a piece of paper with the expected key signature seems like a reasonable precaution.
There used to be that "key art" that was posted to make it more visibly distinct, but I think that feature got discontinued.
Just disabled by default. Add
to your ~/.ssh/config/ to restore it. I don't agree with the reasons they turned it off, but more importantly, you can get signed SSH host certificates to never see that prompt for that server ever again.
That’s actually a really good point, I remember from the Darknet Diaries podcasts that this is typically how darkweb operators manage their things, not using any storage and starting from a fresh machine every boot.