As we all know the major issue with security is the user itself, because current security systems don’t consider the human factor. Most of the security measures neglect the human limitation in the real world with the result that the users are annoyed by the system. Annoyed users stop paying attention or even worse they stop considering the whole security aspect of the system they are using. OpenSSH 5.1 implements a new (experimental) feature based on an innovative visualization technology, which care about the human being.
Let’s exhibit this with the validation of root keys in public-key infrastructures and user authentication. People have difficulties with remembering strong passwords and personal identification numbers, and they are very slow and unreliable when comparing meaningless hash strings. They start writing passwords everywhere, which means a serious lack of security, and they stop paying attention at public identification strings like RSA fingerprints. Would you spend at least 30 seconds to check and compare two 32 “characters” long HEX strings every time you connect to a server with your SSH client? You should! But I have to admit I don’t do it every time 😉
Why don’t we humanize the whole procedure? Why don’t we make the keys, passwords or fingerprints more readable for the humans?
That’s the idea behind the Hash Visualization, better known as “Random Art”. The goal of Random Art is to improve the security of those systems with a solution, which replaces the hash strings with more human readable images. It’s easier for the human brain to remember or even compare a picture than an long sequence of numbers and characters without any semantic meaning.
For further information about Hash Visualization check the official paper: http://sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf
It’s exciting to know that OpenSSH-5.1 comes with this feature. OpenSSH-5.1 introduces the experimental SSH Fingerprint ASCII Visualization, inspired by the Hash Visualization schemes explained before.
The fingerprint visualization is controlled by a new config option “VisualHostKey” and it’s disabled by default, because the algorithm used to generate the random ASCII art is still experimental and subject to changes.
Let’s see how it works:
When you connect to remote host via SSH, your SSH client performs some checks on the server key. If it changed, you would see an output like following:
user@client:~$ ssh server.ch
The authenticity of host 'server.ch (1.1.1.1)' can't be established.
RSA key fingerprint is 77:20:22:ab:42:5a:60:ea:f9:38:7a:07:56:d2:92:b1.
Are you sure you want to continue connecting (yes/no)?
Now with the new OpenSSH version you can set the VisualHostKey option to “yes” and you will see the following prompt:
user@client:~$ ssh server.ch
The authenticity of host 'server.ch (1.1.1.1)' can't be established.
RSA key fingerprint is 77:20:22:ab:42:5a:60:ea:f9:38:7a:07:56:d2:92:b1.
+--[ RSA 2048]----+
| . |
| + |
| = . . . |
| E.o o . . |
| o+ . S . . |
| oo + . . . |
| . .= + |
| oo.= |
|.o.oo |
+-----------------+
Are you sure you want to continue connecting (yes/no)?
It’s open to dispute if this feature is already usable or not. But in my opinion this represents one of the first steps to a more user-friendly security solution.
