3 ms·

> That's good in that it requires a slightly more sophisticated attack, but I don't really view that as a very effective defense. A slightly more sophisticated

by Wicher 12y ago

> That's good in that it requires a slightly more sophisticated attack, but I don't really view that as a very effective defense. A slightly more sophisticated attack, indeed — but one that doesn't scale well. It ups the cost of mass surveillance tremendously.

copsarebastards 12y ago
I hear this frequently but I don't buy it. What about the MITM scales worse than a passive listener? As far as I can tell, both insertion of a passive listener and a MITM are algorithmically O(n) on the number of connections being surveilled. All you're increasing for the MITM is the constant factor. When you're on the order of billions of connections being surveilled, even linear growth is hard, but we know that the NSA already has done that. Increasing the difficulty by a constant factor is not much harder, and there's no question that the NSA has the budget to do so. And in fact, the constant factor isn't even large: it's whatever the resource costs of two connection handshakes per connection is, plus decryption/encryption on the data flowing across, all of which are highly optimized algorithms at this point.
- Wicher 12y ago
  No. Passively listening only requires dumping whatever flies over the interface of some router. Done! Very hard to detect. You can also just scan for keywords and only start dumping traffic when triggered. With SSL, you cannot retroactively decide that you'd want to dump traffic. You have to MITM from the beginning. That's point 1. Point 2: Detection. Actively MITM-ing an SSL connection requires you to (if the CA Chain-O'-Trust works as supposed) give away the fact that you own a (valuable!) compromised CA authoritative cert. You would want to use such a cert for a targeted attack, not waste it on blanket surveillance and get found out (and called out) within a couple of days. If you don't own a root cert but rely on vulnerable implementations, or implementations such as this one which do not rely on the CA infra, same story. You do not want to waste that on blanket surveillance and get caught. You'd save it for the /special occasions/. SSL-MITMing everyone, all the time, as in blanket surveillance, is unfeasable even without CA chains. You'll get called out on it by people that do check cert fingerprints once in a while. This is a different kind of scalability than the computational order-of-complexity one that you seem to be thinking about.

by Wicher 12y ago

copsarebastards 12y ago

I hear this frequently but I don't buy it. What about the MITM scales worse than a passive listener? As far as I can tell, both insertion of a passive listener and a MITM are algorithmically O(n) on the number of connections being surveilled. All you're increasing for the MITM is the constant factor. When you're on the order of billions of connections being surveilled, even linear growth is hard, but we know that the NSA already has done that. Increasing the difficulty by a constant factor is not much harder, and there's no question that the NSA has the budget to do so. And in fact, the constant factor isn't even large: it's whatever the resource costs of two connection handshakes per connection is, plus decryption/encryption on the data flowing across, all of which are highly optimized algorithms at this point.

Wicher 12y ago
No. Passively listening only requires dumping whatever flies over the interface of some router. Done! Very hard to detect. You can also just scan for keywords and only start dumping traffic when triggered. With SSL, you cannot retroactively decide that you'd want to dump traffic. You have to MITM from the beginning. That's point 1. Point 2: Detection. Actively MITM-ing an SSL connection requires you to (if the CA Chain-O'-Trust works as supposed) give away the fact that you own a (valuable!) compromised CA authoritative cert. You would want to use such a cert for a targeted attack, not waste it on blanket surveillance and get found out (and called out) within a couple of days. If you don't own a root cert but rely on vulnerable implementations, or implementations such as this one which do not rely on the CA infra, same story. You do not want to waste that on blanket surveillance and get caught. You'd save it for the /special occasions/. SSL-MITMing everyone, all the time, as in blanket surveillance, is unfeasable even without CA chains. You'll get called out on it by people that do check cert fingerprints once in a while. This is a different kind of scalability than the computational order-of-complexity one that you seem to be thinking about.