Daniel
Premium,MVM
join:2000-06-26
Pleasanton, CA
clubs: 
2 edits | reply to Name Game
Re: Is Portknocking "Real" Security?
Your analogy is horribly flawed, Name Game. Nobody gets a "key" to the cottage. A "key" implies that a successful portknock yields a shell via SSH. It doesn't. All a successful portknock gives you is the ability to try one's hand against standard SSH security. No security layers are removed from the equation; one is just added.
Do you still think this is a problem?
--
dmiessler.com -- grep understanding knowledge |
|
Name Game
Premium
join:2002-07-07
North Myrtle Beach, SC
| reply to Daniel
The concept of portknocking from the day's it was proposed using firewall logs changed into a "secret knock" thingie is like giving your neighbor a key to you cottage and trust him to protect it. Not only protect the "key"..but also your place. You do not know where he will store the key muchless when "he" enters your cottage if it was really his muddy feet in the buffer overflow.
If you are looking for peace of mind Security..the weighted scale is against portknocking..but if you are just after a new whistle and bell "feature" then go for it..it does not ADD anything to real security..it just throw another problem into the equation...no matter how secure you think you are doing it.
I will be standing in the hallway 
»www.songlyrics.com/song-lyrics/O···534.html
"Knock three times
On the ceiling if you want me.
Mmm-hmm, twice on the pipe
If the answer is no."
--
Gladiator Security Forum »www.gladiator-antivirus.com/ Missing Kids »www.missingkids.com/ |
|
