From: Eric Hodel <drbrain@...7.net>
Date: 2007-09-28T07:15:05+09:00
Subject: Re: Vlad the D. - help and observations

On Sep 27, 2007, at 14:51 , Marcin Raczkowski wrote:
>> You mean you didn't do that when you logged into your box the very  
>> first time?  What about when you need to upgrade some core  
>> package?  I simply can't live without ssh-agent!
>
> ssh agent (that comes with putty) is (or at least was 1 y ago)  
> there was bunch of exploits for it.
>
> In company i was working recently, we had to have keys with  
> password anyway :]
>
> so mayby using sessions is better idea

If you're going to be paranoid about keys, passwords and security  
your choice is between an SSH toolset written in a garbage collected  
language (that may leave passwords and unencrypted keys available to  
a debugger for "long" periods of time) used by thousands to tens of  
thousands of users (Net::SSH) or an SSH toolset written in a manual  
memory management library (that may leave passwords and unencrypted  
keys available forever to a debugger due to leaks) with millions to  
tens of millions of users (OpenSSH).

Even if you aren't using OpenSSH's ssh-agent, you've still probably  
got tens of thousands to hundreds of thousands of users to paranoidly  
scour the code for security exploits.

I doubt that anybody has paranoidly scoured Net::SSH looking for ways  
to pull your passwords and keys out of it.  There certainly have been  
people paranoidly scouring OpenSSH and putty's code looking for  
exploits.

This document contains forward-looking statements.  Past  
vulnerability is no guarantee of future vulnerability.