3 ms·
I wouldn't. But if I'm using an unencrypted connection I know for sure that everything is readable all along the way. It seems to me that implicit in the argum
by foundart 12y ago
I wouldn't. But if I'm using an unencrypted connection I know for sure that everything is readable all along the way.
It seems to me that implicit in the argument against option 3 is the assumption that if we have a system in which encryption is not tied to authentication that the net will be filled with MITM attackers, thus effectively rendering option 3 identical to option 1.
Is that a valid assumption?
- snowwrestler 12y agoYes. With modern tools MITM is akin to spam: almost no marginal cost, so even if it only hooks a few people, it's worth trying. Here are some examples: http://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-for-hs-ok/ http://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-f... http://gizmodo.com/gogo-is-using-man-in-the-middle-malware-tactics-on-its-1677559652 http://gizmodo.com/gogo-is-using-man-in-the-middle-malware-t... Keep in mind these are legitimate, professional ISPs doing this, so we're not even into criminal or state-level MITM attempts, let alone basic griefing tools like Firesheep. So yes, it is a valid assumption that the net is filled with MITM attackers.