Subject: Re: rcp or scp
To: Perry E. Metzger <perry@piermont.com>
From: David Laight <david@l8s.co.uk>
List: netbsd-help
Date: 11/22/2003 08:25:40
> 
> FYI, in general, no one should use rcp instead of ssh/scp on the open
> internet. It is arguable they shouldn't be used behind a firewall,
> either, if you don't have some pressing reason to use them.

Isn't rcp arguably more secure than ftp?
To break rcp you need to subvert the reverse DNS.
OTOH a trivial program [1] running on a LAN in promiscuous mode
can detect usernames and passwords from ftp and pop3 (and other)
connections.

	David

[1] I know someone who wrote it, ran it on the corporate LAN, saw the
number of root passwords that went past and immediately deleted the source.

-- 
David Laight: david@l8s.co.uk