5 ms·
All key exchanges are vulnerable to an active MITM attack, whether using pigments or some cryptographic key exchange. The only way around it? Some other method
by infogulch 12y ago
All key exchanges are vulnerable to an active MITM attack, whether using pigments or some cryptographic key exchange.
The only way around it? Some other method of verifying the key, which isn't vulnerable to a MITM, like meeting in person, or using Certificate Authorities.
- rosser 12y agoHence key-signing parties. People are still doing those, aren't they?
- stcredzero 12y agoSomeone needs to write fiction about bringing rufies to a key signing party.
- privong 12y agoxkcd 364 is close: https://xkcd.com/364/ https://xkcd.com/364/
- prezjordan 12y agoWe did one last semester at my school's cybersecurity club. I don't really know much about cybersecurity, just a hobbyist, but I had a fun time nerding out and giving freshmen a tough time with their drivers licenses.
- colordrops 12y agoMeeting in person is vulnerable to hollywood makeup and scopolamine attacks.
- oleganza 12y agoNick Szabo suggested to leave small holes unplugged: http://blog.oleganza.com/post/69174500046/leaving-small-holes-unplugged http://blog.oleganza.com/post/69174500046/leaving-small-hole...
- shinigami 12y agoNSA approves.
- BuildTheRobots 12y agoOr using SAS [1] and PGP check words [2] ala implementations like ZRTP [1] edit: I realize the salient point is that this gives you assurance that the encryption handshake hasn't be intercepted but no guarantee as to the identity of the person you've connected to. With real-time VoIP this potentially isn't a problem (yet) as it's relatively obvious who you're chatting to on the phone. [1] http://en.wikipedia.org/wiki/ZRTP#SAS http://en.wikipedia.org/wiki/ZRTP#SAS [2] http://en.wikipedia.org/wiki/PGP_word_list http://en.wikipedia.org/wiki/PGP_word_list