I've been doing IP networking from early 90s and I didn't find anything new in this article, except false claims. Also many attacks weren't as advanced as I wou

I've been doing IP networking from early 90s and I didn't find anything new in this article, except false claims. Also many attacks weren't as advanced as I would have assumed. Btw. With Windos 3.0 Trumpet Winsock allowed you directly to snoop IP traffic as well as packet content. So there's nothing new with it either. I also worked in networking department monitoring network issues, and it was painfully clear, that anyone who used telnet to access bank was easily monitored. (of course) Best thing was that banks didn't offer back then any other alternatives, except traditional POTS modems, which were just being replaced by IP networking. Oh boy did I laugh about firesheep news, it was so obvious and over 15 years old trick. I was naturally expecing this post to contain information how to MitM HTTPS and SSH sessions. Yes, users are stupid, and they might continue accessing services and login, even if cert isn't valid. As addition to that, they could have listed tips, how to create own cert authority and create "self signed" certs for every site being accssed with HTTPS. We're currently doing that in corporate environment. Only thing you need to arrange, is to use AD to get devices to trust this new cert. When you access facebook.com you'll get valid https connection with cert signed by IT. Yes, we can evasedrop and virus monitor also https connections, of course. I'm sure there are many guys who have much more to add to this short list, what can be done. Often with high security sites we opt to trust predefined exact public key fingerprint instead of any "publicly" signed cert. Because we all know the problems with official publicly signed certs and authorities.