Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse

Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by pnutjam on Monday October 16, 2017 @09:40AM (#15483067)

Any https traffic is going to be safe from this attack, a VPN would also protect you.

[ Parent | on HN ]

Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by mceachen on Monday October 16, 2017 @01:50PM (#15485185)

From TFA:

Although websites or apps may use HTTPS as an additional layer of protection, we warn that this extra protection can (still) be bypassed in a worrying number of situations. For example, HTTPS was previously bypassed in non-browser software, in Apple's iOS and OS X, in Android apps, in Android apps again, in banking apps, and even in VPN apps.

[ Parent | on HN ]

Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by willstrafach on Monday October 16, 2017 @06:25PM (#15487154)

This only applies to apps which screw up validation of TLS certificates. There is an unfortunate amount of them, but certainly does not apply to all apps (and not an issue for websites).

Either way, this disclosed vulnerability only involves link layer man-in-the-middle in order to collect traffic. Active manipulation of traffic (Required for TLS intercept) is more complicated.

[ Parent | on HN ]