Comment on Stop MitM on the first SSH connection, on any VPS or cloud providerparentComments−comex4moPublic keys can go over channels that an attacker can read. They cannot go over channels that an attacker can modify. (Which would include the SSH connection itself, until such time as you’ve verified the key through a trustworthy channel.)−washingupliquid4moA public key is useless without the private key. Which the attacker in this unlikely scenario doesn't have.So you login the first time and they either match, or they don't. If they don't you start over. The end.Ignore the fact that most people will probably use the box to host a poorly coded vulnerable service anyway.−akerl_4moIf you’re being MITM’d, they’ll also match, because you’ll end up connected to an environment of the attacker’s choosing.
Comments
Public keys can go over channels that an attacker can read. They cannot go over channels that an attacker can modify. (Which would include the SSH connection itself, until such time as you’ve verified the key through a trustworthy channel.)
A public key is useless without the private key. Which the attacker in this unlikely scenario doesn't have.
So you login the first time and they either match, or they don't. If they don't you start over. The end.
Ignore the fact that most people will probably use the box to host a poorly coded vulnerable service anyway.
If you’re being MITM’d, they’ll also match, because you’ll end up connected to an environment of the attacker’s choosing.