Re: How can Putty load my public key generated with OpenSSH

From: Simon Tatham (anakin_at_pobox.com)
Date: 10/24/03 

Date: 24 Oct 2003 09:20:35 +0100 (BST)

Ralph <rgreen@preferredstaff.net> wrote:
> Before I send anyone this, could I get a comment or two from someone
> else. Is this just a clever ploy to get me to post my private key,
> which could be extracted from this log somehow? I don't mean any
> offense, but I wondered about this as soon as I read your message.

*grin* No offence taken. One of the most frustrating things about
being a security developer is most people's tendency to trust things
blindly - you wouldn't _believe_ the number of people who've asked
us to put an `accept all host keys unconditionally' option into
PuTTY. It's refreshing to see someone actually being cautious about
this sort of thing!

I would explain why what I'm asking is not a risk, but you're quite
right that it would be better if someone else did it so you had
independent confirmation :-)

I will say, though, that if you type your _password_ into an SSH
session then you most certainly should _not_ send the SSH packet log
to anybody without first finding the password and editing it out.
(My impression from your previous posts was that you weren't doing
this.)

Cheers,
Simon 

-- 
Simon Tatham         "Happiness is having a large, warm, loving,
<anakin@pobox.com>    caring, close-knit family in another city."