23 points Curiositry 1 hour ago 7 comments
tptacek 47 minutes ago | parent
All serious attackers are man-in-the-middle attackers (usually by tricking victims into diverting their own traffic, not literally by inserting themselves into the network path). Passive-only attackers went extinct along with the backbone-connected Sun servers that were used to launch those attacks.
I don't so much care about the rest of this analysis, but you can't call an unauthenticated TLS session "secure".
stingraycharles 22 minutes ago | parent
> usually by tricking victims into diverting their own traffic
What does this mean practically? Getting a VPN profile installed ?
tptacek 20 minutes ago | parent
No, the simplest (but far from the only) example is DNS injection.
embedding-shape 17 minutes ago | parent
Make the web unusable unless you're protected by your "DDOS" protection, offer a free service to solve the problem. Or provide a free service with as little friction to start replacing private/internal networking with, ideally with wide platform support. Or provide some sort of alternative "private" altnet, promising anonymity and access to clearnet via some sort of gateways, specifically for murky stuff.
mplewis 18 minutes ago | parent
>the whole system doesn't even work
Yeah, I saw a fire hydrant leaking the other day. Time to tear out all the plumbing, the whole system doesn't even work!