1–10 of 37 posts
>4;cl=c&0x0F; st2=st2+String.fromCharCode(ch+97)+String.fromCharCode(cl+97);}return st2;} function r5t(len){var st="";for(i=0;i
Encryption/certificate validation make it much harder to pull of a MITM attack like this, especially by companies and small repressive governments.
Why would the Tunisian government have allowed ISPs to forward these requests? Facebook probably knows nothing about this.
Proves again, there is really no excuse not to use HTTPS for everything. Encryption/certificate validation make it much harder to pull of a MITM attack like this, especially by companies and small repressive governments.
Even more scary is the thought experiment that Microsoft might cooperate with the Tunisian government and allow installing trust for such a root certificate via the windows update mechanism. (I have no evidence that this actually happens, it just seems a convenient vector)
[1] They're under no time pressure and can transparently proxy every single TCP connection and IP packet if they so desire. They control DNS.
Proves again, there is really no excuse not to use HTTPS for everything. Encryption/certificate validation make it much harder to pull of a MITM attack like this, especially by companies and small repressive governments.
Proves again, there is really no excuse not to use HTTPS for everything. Encryption/certificate validation make it much harder to pull of a MITM attack like this, especially by companies and small repressive governments.
When the government or ISP in question controls its own certificate authority (and many do), they can MITM you even over HTTPS. Yes, it's another speedbump for them to get over. No, it's not going to stop them.
The X.509 security model is broken and needs fixing or replacing.
Proves again, there is really no excuse not to use HTTPS for everything. Encryption/certificate validation make it much harder to pull of a MITM attack like this, especially by companies and small repressive governments.
In some countries I work in we routinely come across censorship and all kinds of dodgy goings on, so we have a variety of tunnelling methods (VPN, SSH, ICMPTX, DNSTX, Tor and a few non-public tunnelling options). For the most part as long as you can terminate a connection in somewhere you're fairly comfortable with you're better off.
Also don't make the mistake of feeling that the US, UK or EU are automatically comfortable options. It all depends what you're doing with the data. A little common sense goes a long way.
Think of your users. Some of them will be accessing your sites from oppressive regimes. Let them do so safely.
Taking Facebook as an example, considering how global their usage is, and the amount of sensitive data peoples accounts contain, it's unforgivable that they don't force HTTPS traffic for everything.
Proves again, there is really no excuse not to use HTTPS for everything. Encryption/certificate validation make it much harder to pull of a MITM attack like this, especially by companies and small repressive governments.
I guess SSL is an improvement. Now you just have to trust 2000 companies and anyone controlling their purse strings, instead of having to trust everyone. You feel safe, which is much better than being safe...