News for hackers. Stuff that matters.

A comment on Universal SSL. Parent comment

Re:Universal SSL by peterwwillis on Monday September 29, 2014 @12:17PM (#8383554)
This is the nail-clipper defense. For cases where a terrorist might take over a plane by threatening to give people tiny cuts or jabs, taking away nail clippers 'protects enormously'.

How often have you encountered read-only network access? It doesn't happen in reality; even the middle hop in a route has total control over the flow of traffic and thus can terminate it and mitm on reconnect. In any case, confidentiality is next to worthless without integrity and non-repudiation.

[ Parent | on HN ]
Re:Universal SSL by ceejayoz on Monday September 29, 2014 @12:31PM (#8383640)
> How often have you encountered read-only network access?

Public wireless points (i.e. Firesheep), any network with a hub instead of a switch...

[ Parent | on HN ]
Re:Universal SSL by peterwwillis on Monday September 29, 2014 @02:36PM (#8384369)
None of those are read-only.
[ Parent | on HN ]
Re:Universal SSL by ceejayoz on Monday September 29, 2014 @04:31PM (#8385109)
I don't recall ever being on a public hotspot that let me change its DNS settings to hijack other users' Facebook traffic.
[ Parent | on HN ]
Re:Universal SSL by peterwwillis on Monday September 29, 2014 @06:32PM (#8385717)
DNS spoofing is the most trivial attack there is on a public hotspot. The 'dnsspoof' tool was packaged with DSniff over 13 years ago. Even if you don't directly spoof DNS, there's a bunch of ways to intercept or change DNS traffic on a public hotspot, like ARP, IP or access point hijacking. Any 'how to hack' book will cover it.
[ Parent | on HN ]