3 ms·

You can't securely exchange keys to do #2 without having #1. Not sure why you think active attacks are more rare than any other attack against TLS/SSL sessions

by brl 18y ago

You can't securely exchange keys to do #2 without having #1. Not sure why you think active attacks are more rare than any other attack against TLS/SSL sessions. Any time you are in a position to perform a passive attack (snooping) you could also perform an active attack (MITM). The only difference is which point-and-click attack tool you download.

ars 18y ago
Not true - otherwise self signed certificates would be pointless. #1 and #2 are independent. And you can snoop WiFi, but you can't do MITM. (Not easily anyway, you'd need a radio jammer and other gear.)
- brl 18y ago
  Of course I can perform a MITM attack on a wireless network. You might try thinking about the communication layers above PHY. Almost any of them will do.
- cperciva 18y ago
  Self signed certificates are pointless, unless you verify the certificate hash out of band.