35-year-old vulnerability discovered in scp
I think I'm missing something.  Step one is getting you to use a compromised server.  Which either means the server your home directory is on is compromised (I’m assuming you have a login on the box, separate from your local home dir), in which case scp is the least of your worries, or they get you to bounce through a MITM server, in which case you have to accept an incorrect host key.<p>If you're accepting incorrect host keys, then you're completely breaking the ssh security model anyway.<p>I guess I don't understand how this is actually any worse than how ssh already worked?<p>Edit: To clarify, I understand why you’d want to fix this, for a good depth of defense. I’m just saying I don’t feel any urgency in fixing this.