4 ms·

I'm going to have to write an article about "no public wifi" and setup a proper vpn for everyone I know. I just finished reading about hijacking google analytic

I'm going to have to write an article about "no public wifi" and setup a proper vpn for everyone I know. I just finished reading about hijacking google analytics's js and setting the cache expiration for a year in the future. This means someone can hijack every page that uses tracking in your browser until you clear your cache. The thing that kills me is that there's just no need for it, lets move vpn's into common practice and lets update our ssl libraries (microsoft!) That caching trick also means, if you get your paypal "jacked" once, it can persist when you're back on a secure connection.

holdenk 17y ago
VPNs however add considerable latency as well as cost and complexity. Its not like there is no down side to using VPNs. If your using SSH and a web browser which isn't susceptible to the current SSL exploits, I don't see why I would want to use a VPN over Wi-Fi.
- thwarted 17y ago
  DNS lookups are not currently signed nor authenticated, neither of which go through ssh or the browser's SSL stack, which is a major attack vector for MITM.
  - tptacek 17y ago
    SSL was designed not to care that DNS is insecure. Heading off one likely response to this comment: it is silly to look at a bug in probably the best-tested piece of security code on the planet (Microsoft's CryptoAPI/schannel code) and arrive at the conclusion that DNSSEC, a protocol nobody has ever deployed successful at scale, isn't hiding many worse bugs. The same obviously goes for SSH, which uses key continuity so as not to care that DNS is insecure.
    - thwarted 17y ago
      While all that's true, it's not the design of SSL that is at issue, but rather bugs in the SSL stack, such as this null-prefix certificates issue. While I don't know the state of Microsoft's stack for this bug, ubuntu just released a patch for wget yesterday for it (USN-842-1, CVE-2009-3490). No one is really talking about DNSSEC, but if you were using a wifi connection (the original use case in this thread of using a VPN over wifi) and thought you were secure because you were using SSL, MITM via DNS is still a possible attack vector, as hapless points out elsewhere in these comments. Obviously a VPN over wifi wouldn't secure you for accessing paypal.com via SSL (which is a public resource), but other, private resources secured with only SSL but resolved via public DNS are at risk (wifi or not).

holdenk 17y ago

VPNs however add considerable latency as well as cost and complexity. Its not like there is no down side to using VPNs. If your using SSH and a web browser which isn't susceptible to the current SSL exploits, I don't see why I would want to use a VPN over Wi-Fi.

thwarted 17y ago
DNS lookups are not currently signed nor authenticated, neither of which go through ssh or the browser's SSL stack, which is a major attack vector for MITM.
- tptacek 17y ago
  SSL was designed not to care that DNS is insecure. Heading off one likely response to this comment: it is silly to look at a bug in probably the best-tested piece of security code on the planet (Microsoft's CryptoAPI/schannel code) and arrive at the conclusion that DNSSEC, a protocol nobody has ever deployed successful at scale, isn't hiding many worse bugs. The same obviously goes for SSH, which uses key continuity so as not to care that DNS is insecure.
  - thwarted 17y ago
    While all that's true, it's not the design of SSL that is at issue, but rather bugs in the SSL stack, such as this null-prefix certificates issue. While I don't know the state of Microsoft's stack for this bug, ubuntu just released a patch for wget yesterday for it (USN-842-1, CVE-2009-3490). No one is really talking about DNSSEC, but if you were using a wifi connection (the original use case in this thread of using a VPN over wifi) and thought you were secure because you were using SSL, MITM via DNS is still a possible attack vector, as hapless points out elsewhere in these comments. Obviously a VPN over wifi wouldn't secure you for accessing paypal.com via SSL (which is a public resource), but other, private resources secured with only SSL but resolved via public DNS are at risk (wifi or not).