This morning there was a post on Slashdot about two *blackhat* talks about pointless twists on the PortKnocking concept, in which one of the authors confuses the concept of a one time password and a one time pad. Man, it doesn't take much to be considered a computer security expert these days.

Between a flashy website, articles in all the major admin journals, Blackhat talks, and endorsement from Bruce Schneier, its quite clear that this is one meme that has gone too far. It occurred to me that I could write a single packer stealth authenticator with better security and more flexibility then most pork knocker implementations in a single afternoon, so I did a google search, and fortunately somebody already did it.

] This particular implementation deviates a bit from his
] original proposal, in that the doorman watches for only a
] single UDP packet.   To get the doorman to open up, the
] packet must contain an MD5 hash which correctly hashes a
] shared secret, salted with the client's IP address and
] the (correctly rounded) time-of-day.

No replay, no multi-port silliness, no problems with route flaps fucking up your authentication, lots of features. Straight up protection from port scanners without all of the lunacy. If you think portknocking is "cool" this is what you are looking for. You can stop writing presentations for hacker cons. Its over.

The Doorman - Putting this portknocking silliness to rest