Re: [tlug] telnet'ing to home with Java servlet

["Benjamin Fleckenstein" <mail@example.com>]

Hi,

> Just to make sure I am getting this right, while one-time passwords
> protect you from people grabbing your password as it passes, if you are
> giving it to a man-in-the-middle, he or she just takes the password, logs
> into the real server, and does damage at will. Right?

In fact every system that doesn't authenticate the other side ist
vulnerable to man-in-the-middle attack.

> Is there a better way, then? To be honest, I thought that one-time,
> disposable passwords were pretty cool when I first heard about them.

I don't know the whole discussion, because I joined the list just today
morning, but it would be better to use SSH with a public key mechanism.
With this the password can't be grabbed because there will no password be
sended and all information is encrypted.


Ben