Host key warnings get ignored partly because tooling makes it so easy — half the CI configs I’ve seen run with strict host key checking off, and accept-new silently trusts whatever key shows up on first connect. And that’s the real weak spot here: TOFU only protects you from the second connection onward. On a first connection through a hostile exit node, the attacker just presents their own key, you pin the wrong one, and no warning ever fires. Ebury being the payload tracks too, that thing’s been harvesting SSH credentials for over a decade and the takedowns never seem to get everyone. Kind of impressive someone compromised 333 exits at once though, that’s over 10% of the network.
Host key warnings get ignored partly because tooling makes it so easy — half the CI configs I’ve seen run with strict host key checking off, and
accept-newsilently trusts whatever key shows up on first connect. And that’s the real weak spot here: TOFU only protects you from the second connection onward. On a first connection through a hostile exit node, the attacker just presents their own key, you pin the wrong one, and no warning ever fires. Ebury being the payload tracks too, that thing’s been harvesting SSH credentials for over a decade and the takedowns never seem to get everyone. Kind of impressive someone compromised 333 exits at once though, that’s over 10% of the network.