ARP-spoofing defense

Levi Pearson levi at
Thu Mar 15 09:59:18 MDT 2007

Andy Bradford <amb-plug at> writes:
> How about you just put a  known_hosts with all your host fingerprints in
> it on  your laptop  before you connect  from offsite?  Hopefully offsite
> doesn't mean connecting from public  computer systems... All it takes is
> one PC that you think can be trusted that has a keylogger running on it.

As I understand it, the host key fingerprints are more of a tripwire
than a prevention mechanism.  The assumption is that a
man-in-the-middle attack will not happen every time, so if one ever
/does/ happen, you become aware of it thanks to an inconsistency in
the host key verification process.  Apparently Phil Zimmerman (of PGP
fame) is planning to use this same model with the secure VoIP system
he's creating.  If it's secure enough for him, it's secure enough for
me.  I guess I lack the paranoia you guys have.


More information about the PLUG mailing list