Item

megous · 2026-10-27T23:52:29.000Z

Naive. There's not much that prevents you from running ssh over https. Not even traffic patterns will give you up in the age of ubiquitous websockets and/or http2 streams.

toast0 · 2026-10-28T20:55:49.000Z

> Not even traffic patterns will give you up in the age of ubiquitous websockets and/or http2 streams.

SSH is dead simple to detect, because the server sends an outbound greeting in ASCII text; and the client doesn't send anything until it gets the greeting. The binary protocol does not look like a TLS stream at all either.

InsidiousWombat · 2026-10-28T11:47:03.000Z

It will absolutely and trivially be detected by any decent IDS/IPS

SSH does nothing to hide it is SSH (tho "I'm just https" mode would certainly be welcome addition)

sandos · 2026-10-28T08:25:44.000Z

Even with corporate MITM setups? I somehow doubt it..

LeBit · 2026-10-28T09:49:29.000Z

No need for MITM.

DPI immediately can tell it is ssh.

megous · 2026-10-28T10:43:01.000Z

Yeah, sure. By magic I guess. :)

p_l · 2026-10-28T12:05:48.000Z

No, by DPI. SSH has recognizable signature as does web sockets etc.

Takes flipping one switch for 443 to be made HTTPS + HTTP2 + websocket only by egress firewall if you paid for one with DPI

megous · 2026-10-28T10:28:05.000Z

MITM only works if you allow trust in corporate CA on the outbound HTTPS connections. And why would you?

jon-wood · 2026-10-28T12:08:02.000Z

Its not always the case but many of MITM-ing corporate firewalls are going to immediately drop any TLS connection they can't decrypt on the basis they're coming from an unauthorised device.

LeBit · 2026-10-28T00:14:43.000Z

"Naive”. How ironic.