4 ms·

please folks, dont do your banking on open coffee shop wifi

• sneak 6y ago
  I do this all the time. My machine has a modern browser, up to date OCSP, HSTS already cached, all that. Could you please explain to me the danger or threats you are warning against?
  • jlgaddis 6y ago
    What does "up to date OCSP" even mean? Have you configured your browser(s) to "fail closed" when it comes to OCSP queries? CRL and OCSP behavior has been, well, "not ideal" since basically forever.
• CountSessine 6y ago
  Honest question - why not? My bank uses this cool thing called TLS. What’s the threat model here?
  • modzu 6y ago
    yes legitimate traffic is going to be fully encrypted thanks to TLS, the risk comes from attacks where you believe you're logging into your banking site securely when you're actually not. for example dns cache poisoning, ssl downgrade attacks, etc. in the case of a starbucks, the AP itself is not necessarily secure (under a counter somewhere?) so it's possible users are connecting to a malicious AP. the threat model depends on the level of risk: the convenience may outweigh those risks, it may not. for myself it is one of a few tasks i wouldn't engage in on a network i don't have more trust in, but in retrospect this advice was indeed probably too strong for most.
    • CountSessine 6y ago
      Again - who cares about dns cache poisoning when your cert chain is sound and your browser is sensible about cert downgrades (which all of them are now)? Who cares about how secure the AP is? It’s an encrypted, securely authenticated connection. That’s the whole point of the cert chain. The AP can be as malicious and evil as it wants - good luck usefully tampering with or impersonating my bank’s public key. Again, what’s the threat model here? Exploiting a browser vulnerability? Maybe?