Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse

Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by filomeno on Monday October 16, 2017 @08:23AM (#15482684)

You can (try) to restrict your browsing to HTTPS sites only.

But it's very difficult to ensure that all the communications your device is making (background services, vendor apps...) go through that channel.

[ Parent | on HN ]

Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by krallja on Monday October 16, 2017 @10:35AM (#15483446)

If only there were some certification body that ran an App Store with rules against unencrypted traffic...

[ Parent | on HN ]

Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by haggy on Monday October 16, 2017 @08:28AM (#15482701)

This issue is two-fold right. You can install plugins that force SSL client side (on the main site and any AJAX calls thereafter) but like you said you have no idea what calls that site is making server side. They could be sending everything you send them over plaintext after the initial TLS secured request. Rough times.

[ Parent | on HN ]

Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by Gaelan on Monday October 16, 2017 @10:06AM (#15483262)

Luckily, the servers past the initial SSL link won’t be using wifi, so at least you won’t be any worse off than before.

[ Parent | on HN ]