Re:You have a moral obligation to use crypto
by GauntletWizard on Wednesday February 12, 2014 @03:14AM
(#7223167)
Even without the CA system, SSL (and TLS) is secure against _passive_ MITM attacks; That is, if the attacker cannot alter the data-stream. This is still reasonable for many simple links, but for internet, it is not.
If you've got no verification of the opposite party, literally any computer could be on the other end. The key exchange mechanism is secure, certainly, but any computer can execute it. The attacker can even show you the real website just proxied through, but that's plenty enough to get your password or any other access that the attacker wants.
Re:You have a moral obligation to use crypto
by mnw21cam on Wednesday February 12, 2014 @06:19AM
(#7223715)
A "passive MITM" attack isn't MITM any more - it's just interception. MITM means that the man in the middle is able to control the data stream that both ends see.
If you've got no verification of the opposite party, literally any computer could be on the other end. The key exchange mechanism is secure, certainly, but any computer can execute it. The attacker can even show you the real website just proxied through, but that's plenty enough to get your password or any other access that the attacker wants.