3 ms·

>This just shows how ignorant you (and most) are on the topic of port knocking. You, uh, do know who you're replying to, right? https://sockpuppet.org/me/ http

>This just shows how ignorant you (and most) are on the topic of port knocking. You, uh, do know who you're replying to, right? https://sockpuppet.org/me/ https://sockpuppet.org/me/ if not - I don't mention this to go "lol he must be right because of who he is", but calling a well respected security researcher with plenty of real world street cred ignorant is a bit much. >SPA port knocking is cryptographically secure and does not suffer from replay attacks. SPA port knocking doesn't suffer from passive replay attacks, but it does suffer from block and replay attacks. An active MITM can still get you. His suggestion hasn't been "if you care about security just don't do port knocking", his suggestion has been "if you care about security just throw up a VPN it'll be more secure and just as much work"

ThA0x2 6y ago
>You, uh, do know who you're replying to, right? https://sockpuppet.org/me/ https://sockpuppet.org/me/ if not This means nothing to me? I see a shitty website from probably a has-been "security researcher". >I don't mention this to go "lol he must be right because of who he is", but calling a well respected security researcher with plenty of real world street cred ignorant is a bit much. That's sad. Speaks volumes about how meaningless that term has become. >SPA port knocking doesn't suffer from passive replay attacks, but it does suffer from block and replay attacks. An active MITM can still get you. Wrong. SPA does not suffer from any MITM attacks. >His suggestion hasn't been "if you care about security just don't do port knocking", his suggestion has been No one suggests otherwise. >"if you care about security just throw up a VPN it'll be more secure and just as much work" Not the same amount of work, so no, wrong. If I had a dollar for every billion dollar unicorn that that didn't have a corporate VPN, I'd have a lot of dollars.
- cthalupa 6y ago
  >Wrong. SPA does not suffer from any MITM attacks. Care to elaborate? Not even fwknop documentation claims to be secure from all mitm attacks: >Automatic resolution of external IP address via cipherdyne.org/cgi-bin/myip (this is useful when the fwknop client is run from behind a NAT device). Because the external IP address is encrypted within each SPA packet in this mode, Man-in-the-Middle (MITM) attacks where an inline device intercepts an SPA packet and only forwards it from a different IP in an effort to gain access are thwarted. If I'm MITM'ing you from the same Starbucks or am otherwise behind the same NAT as you, I don't care if you've got the IP encrypted in the packet when I forward it on. >Not the same amount of work, so no, wrong. If I had a dollar for every billion dollar unicorn that that didn't have a corporate VPN, I'd have a lot of dollars. There's not enough billion dollar unicorns out there to actually have a lot of dollars, even if 100% of them lacked corporate VPNs :D Regardless, you don't even need a full on corporate VPN. You can throw up a tiny VM for your VPN in the same private subnet as your servers, only listen on 22 on the private IPs for the servers. You can do this in less than an hour with Wireguard. Super easy.
  - BlueTemplar 6y ago
    How does this work on IPv6 ?
  - ThA0x2 6y ago
    >Care to elaborate? Not even fwknop documentation claims to be secure from all mitm attacks: You made the claim. You prove it with documentation. >If I'm MITM'ing you from the same Starbucks or am otherwise behind the same NAT as you, I don't care if you've got the IP encrypted in the packet when I forward it on. That is by definition NOT a MITM attack. >There's not enough billion dollar unicorns out there to actually have a lot of dollars, even if 100% of them lacked corporate VPNs :D The example is only billion dollar ones. If I include +$10m+ ones, I'd have enough to dollars to buy a new laptop ;D! >Regardless, you don't even need a full on corporate VPN. You can throw up a tiny VM for your VPN in the same private subnet as your servers, only listen on 22 on the private IPs for the servers. You can do this in less than an hour with Wireguard. Super easy. You just described a bastion host, and port knocking makes sense on those as well LOL. Wireguard only currently supports UDP, which can and had been a limitation in the past.
  - tha0x4 6y ago
    >Care to elaborate? Not even fwknop documentation claims to be secure from all mitm attacks: You made the claim. You prove it with documentation. >If I'm MITM'ing you from the same Starbucks or am otherwise behind the same NAT as you, I don't care if you've got the IP encrypted in the packet when I forward it on. That is by definition NOT a MITM attack. >There's not enough billion dollar unicorns out there to actually have a lot of dollars, even if 100% of them lacked corporate VPNs :D The example is only billion dollar ones. If I include +$10m+ ones, I'd have enough to dollars to buy a new laptop ;D! >Regardless, you don't even need a full on corporate VPN. You can throw up a tiny VM for your VPN in the same private subnet as your servers, only listen on 22 on the private IPs for the servers. You can do this in less than an hour with Wireguard. Super easy. You just described a bastion host, and port knocking makes sense on those as well LOL. Wireguard only currently supports UDP, which can and had been a limitation in the past.
    - cthalupa 6y ago

ThA0x2 6y ago

>You, uh, do know who you're replying to, right? https://sockpuppet.org/me/ https://sockpuppet.org/me/ if not This means nothing to me? I see a shitty website from probably a has-been "security researcher". >I don't mention this to go "lol he must be right because of who he is", but calling a well respected security researcher with plenty of real world street cred ignorant is a bit much. That's sad. Speaks volumes about how meaningless that term has become. >SPA port knocking doesn't suffer from passive replay attacks, but it does suffer from block and replay attacks. An active MITM can still get you. Wrong. SPA does not suffer from any MITM attacks. >His suggestion hasn't been "if you care about security just don't do port knocking", his suggestion has been No one suggests otherwise. >"if you care about security just throw up a VPN it'll be more secure and just as much work" Not the same amount of work, so no, wrong. If I had a dollar for every billion dollar unicorn that that didn't have a corporate VPN, I'd have a lot of dollars.

cthalupa 6y ago
>Wrong. SPA does not suffer from any MITM attacks. Care to elaborate? Not even fwknop documentation claims to be secure from all mitm attacks: >Automatic resolution of external IP address via cipherdyne.org/cgi-bin/myip (this is useful when the fwknop client is run from behind a NAT device). Because the external IP address is encrypted within each SPA packet in this mode, Man-in-the-Middle (MITM) attacks where an inline device intercepts an SPA packet and only forwards it from a different IP in an effort to gain access are thwarted. If I'm MITM'ing you from the same Starbucks or am otherwise behind the same NAT as you, I don't care if you've got the IP encrypted in the packet when I forward it on. >Not the same amount of work, so no, wrong. If I had a dollar for every billion dollar unicorn that that didn't have a corporate VPN, I'd have a lot of dollars. There's not enough billion dollar unicorns out there to actually have a lot of dollars, even if 100% of them lacked corporate VPNs :D Regardless, you don't even need a full on corporate VPN. You can throw up a tiny VM for your VPN in the same private subnet as your servers, only listen on 22 on the private IPs for the servers. You can do this in less than an hour with Wireguard. Super easy.
- BlueTemplar 6y ago
  How does this work on IPv6 ?
- ThA0x2 6y ago
  >Care to elaborate? Not even fwknop documentation claims to be secure from all mitm attacks: You made the claim. You prove it with documentation. >If I'm MITM'ing you from the same Starbucks or am otherwise behind the same NAT as you, I don't care if you've got the IP encrypted in the packet when I forward it on. That is by definition NOT a MITM attack. >There's not enough billion dollar unicorns out there to actually have a lot of dollars, even if 100% of them lacked corporate VPNs :D The example is only billion dollar ones. If I include +$10m+ ones, I'd have enough to dollars to buy a new laptop ;D! >Regardless, you don't even need a full on corporate VPN. You can throw up a tiny VM for your VPN in the same private subnet as your servers, only listen on 22 on the private IPs for the servers. You can do this in less than an hour with Wireguard. Super easy. You just described a bastion host, and port knocking makes sense on those as well LOL. Wireguard only currently supports UDP, which can and had been a limitation in the past.
- tha0x4 6y ago
  >Care to elaborate? Not even fwknop documentation claims to be secure from all mitm attacks: You made the claim. You prove it with documentation. >If I'm MITM'ing you from the same Starbucks or am otherwise behind the same NAT as you, I don't care if you've got the IP encrypted in the packet when I forward it on. That is by definition NOT a MITM attack. >There's not enough billion dollar unicorns out there to actually have a lot of dollars, even if 100% of them lacked corporate VPNs :D The example is only billion dollar ones. If I include +$10m+ ones, I'd have enough to dollars to buy a new laptop ;D! >Regardless, you don't even need a full on corporate VPN. You can throw up a tiny VM for your VPN in the same private subnet as your servers, only listen on 22 on the private IPs for the servers. You can do this in less than an hour with Wireguard. Super easy. You just described a bastion host, and port knocking makes sense on those as well LOL. Wireguard only currently supports UDP, which can and had been a limitation in the past.
  - cthalupa 6y ago