> > What exactly do you think "untrusted" means in the phrase "untrusted > > host"? > > That anything and everything will be captured and logged in plain > text. That's what _I_ consider "untrusted". Everything including > the login credentials, but they're a one-time thing. Right? Is > that not the case? > > What am I missing here? This is a very simple question... In the > following sequence, where do I go wrong? > > 1) Log into system via ssh skey, which is a one-time auth method > 2) Type 'sudo farfegnugen blahblah yadda' > 3) Log out > > As I understand things, the attackers now have my one-time auth > info, which won't work again. Right? > > They also know I typed 'sudo fargegnugen blahblah yadda'. Neato. > > And they saw me log out. So, they have an auth string that will > not work, a command that won't work unless they can log in as > me, and they now know how to log out. > > I absolutely admit that I'm an idiot when it comes to this. I > would just appreciate knowing the flaws in this particular plan.
You are trusting that the keylogger does not make the guy show up and take over your one time password session. I can't believe you couldn't see that.
