How was the hacker able to get Facebook credentials? Facebook uses HTTPS and so does Live.com. Even if I'm connected to a malicious router, only me and Facebook know about the data we're sending each other. Am I missing something or should the author of this article provide more evidence on the type of attack?
If an attacker controls the access point he could do the following: * Redirect all HTTPS traffic to an HTTP spoof site. Many users probably wouldn't notice. * If the attacker has access to a short, 2-3 character domain, they could redirect to a wildcard HTTPS connection like, https://facebook.aa.com/ - again, many users wouldn't notice. They'd see "facebook" and the lock icon and assume they're ok. * In either case t…
HSTS and bookmarks... along with settings increasingly built in to a lot of browsers should make it all but impossible to MITM facebook.com.
There is a bit of a weak link with DNSSec, but in truth there are WAY easier ways to get someone's Facebook ID once you can spoof traffic to them.
How was the hacker able to get Facebook credentials? Facebook uses HTTPS and so does Live.com. Even if I'm connected to a malicious router, only me and Facebook know about the data we're sending each other. Am I missing something or should the author of this article provide more evidence on the type of attack?
If an attacker controls the access point he could do the following: * Redirect all HTTPS traffic to an HTTP spoof site. Many users probably wouldn't notice. * If the attacker has access to a short, 2-3 character domain, they could redirect to a wildcard HTTPS connection like, https://facebook.aa.com/ - again, many users wouldn't notice. They'd see "facebook" and the lock icon and assume they're ok. * In either case t…
You can't redirect https traffic to http, without having valid certificate. But of course with all these CA problems, it could be possible to arrange one. It's then another story, if users use http -> https recirection in first place. Due to leaving the https prefix out from the url when connecting the site very first time. That's immediate security fail, but it's up to users to get this straight. HSTS won't help because due to privacy mode, all data between browser sessions will be purged, including HSTS data. Any failure to purge any data between sessions, could break privacy, because then it's known that you have already visited that site. But these questions are quite complex. Which is best configuration for each situation needs to be very carefully considered. I personally like DANE, if I would be running any serious service, I would configure it. Some of my friends have already done that.
Considering how ridiculously cheap an anonymous VPN service is these days I am surprised how many people do not use them.
How sure are you that your cheap anonymous VPN isn't malicious and hasn't been hacked? Is that more or less likely than an attacker being on the same physical wireless network as you?
Well, 'cuz I set it up myself? Mine is running on a home server but it would be just as easy to set up a $5/mo. VPS and set up OpenVPN.
I've read about this kind of thing before, so when I'm in public, or even at school I prefer to fire up my phone's personal hotspot instead of using any public wifi available.
That's good, because now you are just broadcasting your phone's SSID & MAC everywhere. ;-)
If you don't type the https url, you start by visiting the http website. Normally the http version will redirect to https, but a man in the middle can easily prevent this.
https://hstspreload.appspot.com/ says they don't use HSTS as a preload. They should...
Interesting but dated info for techies. I was hoping for something more along the lines of how retailers triangulate & track your movements inside their brick & mortar sites. Or how public providers scrape your browsing habits whilst on their net. I was even more interested in learning what other tricks they employ that I am not yet aware of. With the ubiquity of broadband mobile I recommend avoiding public wifi when…
Retailers can use video footage + motion capture software to track you which works much better as not everyone has active wifi.
Most people don't understand the WPA PSK security model and its insufficiency for anything but private networks where every device is trusted. When you give someone the PSK, you give them the capability to impersonate the access point.
That being said, is there any better solution for public networks? One where giving someone a password doesn't let them impersonate you. I'm not sure how good support for EAP-TLS is on common client devices. To actually make it secure the device would not only need to support it but also validate the AP's public key some way.
Most people don't understand the WPA PSK security model and its insufficiency for anything but private networks where every device is trusted. When you give someone the PSK, you give them the capability to impersonate the access point. That being said, is there any better solution for public networks? One where giving someone a password doesn't let them impersonate you. I'm not sure how good support for EAP-TLS is on…
since theres no url associated any trusted ca-signed cert is valid (for example a cert from startssl).
if you use self signed that actually protects you since then the client complains.
SOME clients pin the certs (thus you cant impersonate the AP even with a trusted CA-signed cert) but its still quite rare.