3 ms·
This is overblown, isn't it? That thing can't do anything that a public wifi couldn't, and yet everyone connects their laptops to those without hassle. SSL is n
by planb 8y ago
This is overblown, isn't it? That thing can't do anything that a public wifi couldn't, and yet everyone connects their laptops to those without hassle. SSL is nearly everywhere now...
- putlake 8y agoExactly. Came here to post this and ask what I'm missing.
- baxtr 8y agoYou might be looking at the difference between HN and reddit as a community
- chrisper 8y agoI still wouldn't use a public wifi without a VPN...
- dirkt 8y agoTest how many SSL connections go the extra mile and secure themselves against Man in the Middle attacks. You'll be surprised.
- thegeomaster 8y agoAll of them, since that's an explicit design goal of SSL/TLS?
- cube00 8y agoIf a user wants their free wifi enough they'll be happy to click through those pesky warnings that the root cert is not trusted. They'll probably not think anything of it if it loads as normal, even with a big angry red cross. The speed at which users rip though Windows UAC warnings is astonishing.
- _verandaguy 8y agohttps:// https:// with no extra options is still very much prone to downgrade/stripping attacks, and first-time connections to an https:// https:// site are particularly vulnerable since a lot of the extra hardening options (HSTS in particular) can be nullified through TOFU.
- hohenheim 8y agoThere is a big difference though. This thing can actually act as an agent in a botnet that could be used for lot of things, such as DDOS'ng.
- SmellyGeekBoy 8y agoWho's to say that the public wifi you're connecting to doesn't have one of these things attached?