Matasano hacked. A humbling lesson, even the pros are vulnerable.

Re:Matasano hacked. A humbling lesson, even the pros are vul... by _b8r0 on Sunday July 26, 2009 @07:19AM (#724308)

Not necessarily. What about exploiting VPN clients? http://www.zerodayinitiative.com/advisories/ZDI-09-024/

There's also the configuration to consider. Using PSK or aggressive mode for VPNs can be considered bad but are you really going to deploy a full RADIUS solution just to access a web server?

Compare this to using public key based auth on SSH, I know which one I'd rather have for a web server.

[ Parent | on HN ]

Re:Matasano hacked. A humbling lesson, even the pros are vul... by ankp on Sunday July 26, 2009 @04:23PM (#724842)

Not necessarily. What about exploiting VPN clients?

IPSec is a disaster, one aspect of which is having a client daemon listening on an open port for isakmp/ike key exchange.

There's also the configuration to consider. Using PSK or aggressive mode for VPNs can be considered bad but are you really going to deploy a full RADIUS solution just to access a web server?

Provisionally "yes", but I'd actually use OpenVPN, wired into our existing directory infrastructure.

Compare this to using public key based auth on SSH, I know which one I'd rather have for a web server.

Why do you consider it a net win to reduce the entry barrier to only one exploit, one bad user password, or one misconfigured host?

[ Parent | on HN ]