Hacker News Reader

Restricting SSH to "known-good" IP addresses is less flexible and less secure than public key authentication.

(Restricting mysql access to localhost and using an SSH tunnel is fine practice, AFAIK.)

It is less flexible, but it is more secure than using public key authentication by itself (public key auth can be used in conjunction with an IP whitelist).

I'm not sure an IP whitelist gives you anything -- it provides a handy mechanism for escalating privileges, both for intrusions on a machine at the "known-good" IP and for unintended network access in general.

Um. No. Bouncing traffic through one device out of probably many at your house (when's the last time you updated the firmware on your TV? Your router?) is a lot more feasible than breaking public key encryption.

Reply on news.ycombinator.com