Nevertheless, S/KEY is vulnerable to a man in the middle attack if used by itself. It is also vulnerable to certain race conditions, such as where an attacker's software sniffs the network to learn the first "N" − 1 characters in the password (where "N" equals the password length), establishes its own TCP session to the server, and in rapid succession tries all valid characters in the "N"-th position until one succeeds. These types of vulnerabilities can be avoided by using ssh, SSL, SPKM, or other encrypted transport layer.