Re: [PATCH] lisp/server.el: Introduction of server-auth-key variable

[Stefan Monnier <monnier@iro.umontreal.ca>]

> +In some situations however, it can be difficult to share randomly
> +generated password with remote hosts (eg. no shared directory),

ssh/scp work fine for me.

> +so you can set the key with this variable and then copy server
> +file to remote host (with possible changes to IP address and/or
> +port if that applies).

IIUC this only makes sense if you want to use a shared key that you keep
for a "long" time (since the intention is to reduce the frequency of
key-distribution).
Now the server keys are sent in the clear over the network, so the
security we provide is rather minimal.  OT1H that means your patch
should be OK since we don't really have security anyway.  OTOH it means
that it makes the security threat more serious.


        Stefan


PS: emacsclient should really try not to send the key in cleartext, but
instead send something like "nonce,hash(nonce,key)".