3 ms·
MitM is blown out of proportion. Afaik, only dns poisoning attacks will result in MitM as effective as phishing or botnets, and poisoning can be mostly-solved w
by peterwwillis 9y ago
MitM is blown out of proportion. Afaik, only dns poisoning attacks will result in MitM as effective as phishing or botnets, and poisoning can be mostly-solved with better resolvers. No criminal anywhere cares about your password going over the wire in a coffee shop.
- zAy0LfpBZLC8mAC 9y agoWhich is true exactly up to the point where some criminal decides it's an attack worth automating, as with every other attack. The one thing that reduces the likelihood of that happening is to minimize the amount of credentials you could get your hands on using that attack.
- throwaway2016a 9y agoIf you have a mass target sure, there are better attacks. But if you target is only a single network, packet sniffing is pretty effective and is stopped by HTTPS. And if you target is a single person or small group of enumerable machines, arp poisoning still works on many (most?) networks. Personally I am more scared of the damage that can be caused by being a direct target than I am having my info in one of those massive dark-web data dumps. Edit: Also, the ops post is actually an example of a MitM (where the ISP is the one in the middle). I just expanded it to the superset.