Trick user to send private key password to compromised host

[Dan Yefimov]

On Tue, 13 May 2008, Roman Fiedler wrote:

> Sorry, seems that my first statement was not precise. If I connect from 
> my uncompromised local host A to some malicious host B, it could trick 
> me to reenter the private key password so that it is captured on B. This 
> would not be possible by installing an kestroke logger on B, only 
> openssh "acts" as the "keystroke logger" in this case.
> 
What the attacker can gain from discovering private key encryption password? 
The private key itself is located on the host the ssh is invoked on, not on the 
remote and probably compromised one.
-- 

    Sincerely Your, Dan.