11–20 of 33 posts
Earlier quoted context omitted.
The same VPNs that use weak DHE crypto? https://weakdh.org/
Just use IKEv2, and you won't be affected. Or just don't use MODP1024.
Earlier quoted context omitted.
Agreed. It looks as though the researchers saw that as a possibility too: "It is possible to temporarily mitigate the flaw by implementing the following workaround: Researchers have demonstrated that ITP can be operated over TLS/DTLS, using certificate-based authentication to ensure the security and integrity of the protocol." I don't really understand why this is only a "temporary mitigation", though, rather than a…
Why is that a "temporary" fix? Segregating insecure protocols to VPNs, encrypted tunnels, and backchannel networks is one of the oldest most time-honored tools in the security design toolbox. Not only is it a real fix, but it's probably the right fix.
:)
Earlier quoted context omitted.
I guess my confidence in the telerobot is lowered by the fact that the protocol doesn't ensure authenticity of surgery instructions. It leads me to believe what other flaws (including those outside the scope of security) exist. Hopefully, we're still testing these surgeries on mice and not men.
A VPN with only two valid certificates means that the guy holding the other cert (assuming you have one of them) is definitely who he says he is.
Earlier quoted context omitted.
Agreed. It looks as though the researchers saw that as a possibility too: "It is possible to temporarily mitigate the flaw by implementing the following workaround: Researchers have demonstrated that ITP can be operated over TLS/DTLS, using certificate-based authentication to ensure the security and integrity of the protocol." I don't really understand why this is only a "temporary mitigation", though, rather than a…
Why is that a "temporary" fix? Segregating insecure protocols to VPNs, encrypted tunnels, and backchannel networks is one of the oldest most time-honored tools in the security design toolbox. Not only is it a real fix, but it's probably the right fix.
EDIT: Easy on the downvotes folks. If you disagree, engage me in discourse. As an infrastructure/network/devops/it generalist role, I have seen terrible things happen when you don't properly segregate critical systems from public networks.
Earlier quoted context omitted.
A VPN with only two valid certificates means that the guy holding the other cert (assuming you have one of them) is definitely who he says he is.
You are right, but I'm alluding to the intrinsic security flaw of the robot. What other flaws could exist? They need not be security related.
Earlier quoted context omitted.
Agreed. It looks as though the researchers saw that as a possibility too: "It is possible to temporarily mitigate the flaw by implementing the following workaround: Researchers have demonstrated that ITP can be operated over TLS/DTLS, using certificate-based authentication to ensure the security and integrity of the protocol." I don't really understand why this is only a "temporary mitigation", though, rather than a…
I guess my confidence in the telerobot is lowered by the fact that the protocol doesn't ensure authenticity of surgery instructions. It leads me to believe what other flaws (including those outside the scope of security) exist. Hopefully, we're still testing these surgeries on mice and not men.
Earlier quoted context omitted.
I guess my confidence in the telerobot is lowered by the fact that the protocol doesn't ensure authenticity of surgery instructions. It leads me to believe what other flaws (including those outside the scope of security) exist. Hopefully, we're still testing these surgeries on mice and not men.
Are you confident that telesurgery developers are better at encryption and authentication than VPN developers?
I've made no commentary on VPN. Just commenting the communication protocol without augmentations (VPN, TLS, certificate, or otherwise) instills little confidence in the rest of the product. I wouldn't want to be operated under the bot.