I'm no security expert, but this discussion leaves a large part of the threat model implicit before discussing countermeasures: what is the asset that needs protecting, who is the threat actor, what is the threat vector, what would be the likelihood and the damage. Not spelling this out leads to a lot of "yeah, but what about XYZ" discussions.
Wi-Fine
41–50 of 57 posts
Re: Wi-Fine
#42"Additional, HSTS (with preloading) is quite widely deployed (especially at big cloud services), which makes plain text downgrade attacks hard to deploy." looooooooooooool Turns out, that was a lie
Is it? I just checked https://hstspreload.org/ , and it seems that twitter.com, facebook.com, outlook.com, cloudflare.com and gmail.com are all preloaded. Or do you mean that downgrade attacks are still easy to deploy? Under what circumstances?
With a reverse proxy. You can reverse proxy any HSTS website, and feed it to any client over plain http
Re: Wi-Fine
#43Oh wow this shit again. @joepie91 you are very wrong about VPNs and this is the sort of mess that gist thread leads to if you ever see this.
Has OP never heard of responder? Things other than browsers are actively making and accepting network requests all the time. Plenty of sites by default have port 80 open and redirect to 443 (can be intercepted).
Please do not spread harmful information. Never (ever) use an open wifi without a VPN.
Edit: My favorite APT that abuses this: https://www.kaspersky.com/resource-center/threats/darkhotel-...
Oh, and if you have corporate VPN make sure there is no split tunneling. And even with a good VPN, make sure to set explicit restrictive host firewall rules. As in no traffic allowed to the public wifi interface subnet aside from captive portal and dhcp (e.g.:wpad)
Re: Wi-Fine
#44In this space, if you have WPA3 then there's no benefit to having a "password" for WiFi which actually is public knowledge. In WPA and WPA2 the password means network use is encrypted, which means a completely passive adversary can't just snoop the network so long as there's a password. But in WPA3 even without a password everything is encrypted anyway, your station says "Hey, I'm joining this network here's a number…
Even for wpa3 if it is public wifi you should use a VPN and restrict LAN traffic because of other hostile clients on the WLAN.
Re: Wi-Fine
#45Love this quote:
> When times change, the wisdom from that past era tends to stay around for a longer while.
Re: Wi-Fine
#46Earlier quoted context omitted.
Is it? I just checked https://hstspreload.org/ , and it seems that twitter.com, facebook.com, outlook.com, cloudflare.com and gmail.com are all preloaded. Or do you mean that downgrade attacks are still easy to deploy? Under what circumstances?
With a reverse proxy. You can reverse proxy any HSTS website, and feed it to any client over plain http
A client with the HSTS preload list will not connect to facebook.com over plan HTTP. That's the whole point.
Re: Wi-Fine
#47HSTS is surprisingly NOT widely deployed, never mind HSTS Preload. Google, Amazon, eBay, BofA or Chase have neither. Facebook, to its credit, does, then again with Facebook your threat model is what’ inside the perimeter.
Re: Wi-Fine
#48This is terrible advise.
Re: Wi-Fine
#49In this space, if you have WPA3 then there's no benefit to having a "password" for WiFi which actually is public knowledge. In WPA and WPA2 the password means network use is encrypted, which means a completely passive adversary can't just snoop the network so long as there's a password. But in WPA3 even without a password everything is encrypted anyway, your station says "Hey, I'm joining this network here's a number…
Re: Wi-Fine
#50As of July 2022, only 55% of sites have secure SSL implementations (configuration errors and renegotiation vulnerabilities seem to drive the 45% who are insecure). - SSL Pulse, Qualys SSL Labs - a monthly scan of security issues in SSL implementations across the top 150k Alexa sites (https://www.ssllabs.com/ssl-pulse/). Methodology (https://github.com/ssllabs/research/wiki/SSL-Server-Rating-G...).
Disclaimer: I'm exploring an open source, community VPN called OpenRelay here: https://github.com/triumphantomato/openrelay