Received: from SOUTH-STATION-ANNEX.MIT.EDU by po7.MIT.EDU (5.61/4.7) id AA06355; Sat, 24 Feb 96 16:40:22 EST Received: from pain.lcs.mit.edu by MIT.EDU with SMTP id AA11960; Sat, 24 Feb 96 16:39:57 EST Received: (from daemon@localhost) by pain.lcs.mit.edu (8.6.12/8.6.12) id QAA08686; Sat, 24 Feb 1996 16:33:09 -0500 Received: (from mycroft@localhost) by pain.lcs.mit.edu (8.6.12/8.6.12) id QAA08678; Sat, 24 Feb 1996 16:33:00 -0500 Date: Sat, 24 Feb 1996 16:33:00 -0500 From: "Charles M. Hannum" Message-Id: <199602242133.QAA08678@pain.lcs.mit.edu> To: jtk@NetBSD.ORG, mckusick@mckusick.com, tls@NetBSD.ORG Subject: Re: telnetd '-a' option to force encryption Cc: netbsd-developers@NetBSD.ORG, perry@NetBSD.ORG, tls@NetBSD.ORG Sender: owner-netbsd-developers@NetBSD.ORG Precedence: first-class X-Loop: netbsd-developers@NetBSD.ORG Being able to force encryption is important because otherwise a man in the middle can inject a "[Trying Kerberos V4 authentication]" etc. into the unencrypted stream, and you'll never really know if you're encrypted or not. A man in the middle can do the same thing for the encryption negotiation itself in the V4 protocol. It's not secure.