4 ms·

This seems so overhyped? Why do you care about encrypting the step from device to access point? If you have sensitive data, then you must encrypt end-to-end any

by qznc 9y ago

This seems so overhyped? Why do you care about encrypting the step from device to access point? If you have sensitive data, then you must encrypt end-to-end anyways, because there are a lot more steps between access point and destination. Thus, HTTPS or Signal or PGP or whatever is enough and WPA does not matter.

mhandley 9y ago
That might be true if we had secure DNS deployed. But we don't, so using this attack, DNS cache poisoning is pretty easy. And if you can subvert DNS, you can redirect HTTPS traffic to a typosquatted version of a website. Unless you check the URL bar every time you visit an HTTPS website that is in your bookmarks, you'll probably not notice, and there goes your password in the clear across a nice secure end-to-end encypted HTTPS connection to the bad guy.
- NoGravitas 9y ago
  Modern browsers are very vociferous about not connecting to https sites with certificate errors. So while DNS cache poisoning with this attack is Very Bad, unless the attacker can insert a bad CA certificate in your browser, or has a valid but improperly-obtained certificate for the website in question, you're not going to fail to notice that something janky is going on.
- PinguTS 9y ago
  And that is actually what the author of KRACK has presented. He re-directed as MTIM via DNS to a different site.
PinguTS 9y ago
There are many services in your local network, which are un-encrypted. Any basic protocol that is in the lower layers required to run the infrastructure like ARP, DHCP, DNS, and alike. Then there are also higher layer protocols, which are un-encrypted like SMB, AFP, NFS, and alike. Many IoT devices, like your Cisco Phone talks TFTP at startup. That is the reason why we have/had WEP, WPA, WPA2 to allow a local infrastructure to have the very same trust like physical cables.
convolvatron 9y ago
apparently this comment has been downvoted. people with very well formed opinions have been saying that end-to-end is the only way, or at least the very best way. it is true, as the responders point out, that some of the control protocols used in the internet blindly trust what they receive. fixing those protocols and ensuring reasonable end to end authentication is a much better use of time than fussing around about a single link level solution. imagine being able to forget about half assed measures like policy based firewalls and stateful nat for security.
cryptonector 9y ago
Yeah, but it's about the IoTs. A great many IoTs have no real security beyond whatever WiFi can provide, and.. you can imagine why: provisioning them with credentials that local systems will be able to validate and trust is.. non-trivial. Worse: IoTs generally have no firmware/software update cycles, so vulnerabilities like this one are forever. My plan is to build tiny one-device wifi/wired bridges for all my IoT devices that have wired ethernet. For the other IoT devices the plan is to update or replace them. What's yours?

by qznc 9y ago

mhandley 9y ago

That might be true if we had secure DNS deployed. But we don't, so using this attack, DNS cache poisoning is pretty easy. And if you can subvert DNS, you can redirect HTTPS traffic to a typosquatted version of a website. Unless you check the URL bar every time you visit an HTTPS website that is in your bookmarks, you'll probably not notice, and there goes your password in the clear across a nice secure end-to-end encypted HTTPS connection to the bad guy.

NoGravitas 9y ago
Modern browsers are very vociferous about not connecting to https sites with certificate errors. So while DNS cache poisoning with this attack is Very Bad, unless the attacker can insert a bad CA certificate in your browser, or has a valid but improperly-obtained certificate for the website in question, you're not going to fail to notice that something janky is going on.
PinguTS 9y ago
And that is actually what the author of KRACK has presented. He re-directed as MTIM via DNS to a different site.

PinguTS 9y ago

There are many services in your local network, which are un-encrypted. Any basic protocol that is in the lower layers required to run the infrastructure like ARP, DHCP, DNS, and alike. Then there are also higher layer protocols, which are un-encrypted like SMB, AFP, NFS, and alike. Many IoT devices, like your Cisco Phone talks TFTP at startup. That is the reason why we have/had WEP, WPA, WPA2 to allow a local infrastructure to have the very same trust like physical cables.

convolvatron 9y ago

apparently this comment has been downvoted. people with very well formed opinions have been saying that end-to-end is the only way, or at least the very best way. it is true, as the responders point out, that some of the control protocols used in the internet blindly trust what they receive. fixing those protocols and ensuring reasonable end to end authentication is a much better use of time than fussing around about a single link level solution. imagine being able to forget about half assed measures like policy based firewalls and stateful nat for security.

cryptonector 9y ago

Yeah, but it's about the IoTs. A great many IoTs have no real security beyond whatever WiFi can provide, and.. you can imagine why: provisioning them with credentials that local systems will be able to validate and trust is.. non-trivial. Worse: IoTs generally have no firmware/software update cycles, so vulnerabilities like this one are forever. My plan is to build tiny one-device wifi/wired bridges for all my IoT devices that have wired ethernet. For the other IoT devices the plan is to update or replace them. What's yours?