Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks

bleepingcomputer.com

Post reply on HN
Print view View original

71–80 of 123 posts

Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks

#71

Post by subway »

creeble wrote: post #69

I'm a little lost on why the need a new root CA cert on a computer that already has a cert store. Can't they safely communicate with whatever.sennheiser.com using the existing certs? Afaict, this isn't a stand-alone device trying to communicate, but your computer, running some app. What am I missing? Edit: okay, I see below that they are using a local web server, and (thanks to browser decisions about localhost) it r…

The really silly thing is that it's 2018 and the browser vendors still refuse to implement name based constraints on certificate authorities. It should be perfectly reasonable for a local, single domain CA to be generated and installed with the application. Instead we treat every CA as worthy to handle every domain always.

Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks

#73

Post by rsynnott »

nimbius wrote: post #33

The comfort in this article is knowing for every boutique german headphone company that insists on becoming a CA, there are thousands of nameless chinese companies producing superior products at lower prices that do to some measure respect the users privacy in that they arent more than just a USB peripheral. Sades and Xiberia for example make perfectly useful (if not a little bit cyberpunk) headsets that just operate…

Sennheiser makes about 700m euro revenue a year. It's a long way from boutique.

Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks

#74

Post by NullPrefix »

DaiPlusPlus wrote: post #70
yjftsjthsd-h wrote: post #53

Earlier quoted context omitted.

OpenBSD's official FAQ has this to say about Flash: Adobe's Flash plugin is distributed in binary form only, and they do not provide a native OpenBSD version. Considering their security record, we thank them for this neglect. The situation is equivalent here; given the kind of software that hardware manufacturers tend to write, I'm quite happy to take volunteer efforts over what they produce.

Every BSD system I’ve used never had X installed, let alone a web-browser - but now I’m curious what a text-mode Flash player would be like.

You don't need X to browse web. There's Lynx.

There's also AAlib, which could help with rendering in text mode.

Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks

#75

Post by softawre »

BenjaminBlair wrote: post #51

Lots of security flaws in code recently. FB and Google+ both leaked, Instagram had a minor leak a week or so ago. It's hard to put blame, I've coded just a bit in my life but I get it how hard it is to write a truly secure and efficient code. Well, on the bright side users can protect themselves against MITM attacks by using a VPN. I'm using Surfshark right now, have tried Zenmate, PIA before, but had some minor issu…

If this isn't an ad for Surfshark, you need to work on your delivery. If it is, shame.

Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks

#76

Post by NullPrefix »

StillBored wrote: post #68

Hmm, I recently picked up a pair of pxc 550s (crazy good black Friday deal), and I saw the thing about installing their android/iphone app to do NFC pairing, but I frankly have no idea why you would want that, or really much of anything else in the app. The reviews even mention that the eq controls don't even work for DRM'ed content. OTOH, it seems if you pair the headphones with normal bluetooth its just using A2DP/…

RMA for miserable sound ?

Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks

#77

Post by StillBored »

NullPrefix wrote: post #76
StillBored wrote: post #68

Hmm, I recently picked up a pair of pxc 550s (crazy good black Friday deal), and I saw the thing about installing their android/iphone app to do NFC pairing, but I frankly have no idea why you would want that, or really much of anything else in the app. The reviews even mention that the eq controls don't even work for DRM'ed content. OTOH, it seems if you pair the headphones with normal bluetooth its just using A2DP/…

RMA for miserable sound ?

The sound is fantastic with the cable, its like night and day, and I don't even consider myself to have very good ears.

Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks

#78

Post by SmellyGeekBoy »

diminoten wrote: post #17
petepete wrote: post #9

Have any hardware companies ever written good accompanying software? From all the custom-ui graphics card config nonsense to utilities that phone home of their own accord, to things like this which are laughably awful. I feel glad I left for the mild shores of Linux in the early 00s.

Yeah, because on Linux the community has to support the hardware because the manufacturer doesn't even bother. Sounds way better...

I'm actually struggling to find any kind of comprehensive list, but I'll point out that I've used Intel, AMD, and NVIDIA first-party drivers in Linux over the years. I'm sure there are countless others.

Re: Sennheiser Headset Software Could Allow Man-In-the-Middle SSL Attacks

#80

Post by rogerbinns »

creeble wrote: post #69

I'm a little lost on why the need a new root CA cert on a computer that already has a cert store. Can't they safely communicate with whatever.sennheiser.com using the existing certs? Afaict, this isn't a stand-alone device trying to communicate, but your computer, running some app. What am I missing? Edit: okay, I see below that they are using a local web server, and (thanks to browser decisions about localhost) it r…

I work on a product that is in a similar boat. We have LAN based remote control using HTTP connections, but have no practical way of TLS enabling it. Stunts like this would work, but are a really bad idea.

The other alternative is to have the devices and remote control connect to a central server over TLS and Internet and then have that server relay traffic. But that is not nice either. However we may be forced into it because of client restrictions on non-TLS connections.

The Plex folks did solve this problem, but it requires a CA to cooperate. I wish someone would step in and help solve it for all. https://blog.filippo.io/how-plex-is-doing-https-for-all-its-...

Post reply on HN