Internet security flaw exposes private data

[Dave Farber <dave () farber net>]

Begin forwarded message:

> From: Dave CROCKER <dhc2 () dcrocker net>
> Date: January 16, 2010 4:24:41 PM EST
> To: dave () farber net
> Cc: Dave Farber <dfarber () me com>, ip <ip () v2 listbox com>, Abe Singer  
> <abe () oyvay nu>
> Subject: Re: [IP] Re:  Internet security flaw exposes private data
> Reply-To: dcrocker () bbiw net

> On 1/16/2010 12:00 PM, Dave Farber wrote:
> > > From: "Abe Singer"<abe () oyvay nu>
> ...
> > > We use SSL for precisely that reason (sidestepping for the moment
> > > usability/trust issues with PKI).
>
>
> It's probably important to bust this popular myth:  regular SSL use  
> would have done nothing for preventing or resolving this problem.
>
> Typical use of SSL provides privacy from wiretapping, but does not  
> prevent misdirection of the connection during setup.
>
> If AT&T was misdirection initial connection setup, then that  
> connection setup would merely have had a "correct" SSL session  
> between the wrong two end-points.
>
> Assuming this really was a NAT mapping error, or some other form of  
> problem in the details of initially arranging the connection, then  
> SSL would not have prevented it.
>
> While SSL does contain the ability to do certain types of client and/ 
> or server authentication, they are not typically part of this sort  
> of activity.  In fact, SSL-based authentication of the client is  
> (almost) never performed, and SSL-based authentication of the server  
> is relatively rare and constrained.
>
> The core point in in the article was that the server produced the  
> wrong image for the user's page:  the entire session landed on the  
> wrong user's account.
>
> While possibly qualifying as a man-in-the-middle problem, formally,  
> it's not of the type that regular use of SSL would affect.
>
> d/
>
> --
>
>  Dave Crocker
>  Brandenburg InternetWorking
>  bbiw.net



-------------------------------------------
Archives: https://www.listbox.com/member/archive/247/=now
RSS Feed: https://www.listbox.com/member/archive/rss/247/
Powered by Listbox: http://www.listbox.com