13 reputation
2
bio website
location
age
visits member for 1 year
seen Nov 22 '13 at 8:26

Apr
19
awarded  Student
Nov
22
awarded  Scholar
Nov
22
accepted Are there any protocols that are truly secure from active and passive MITM attacks?
Nov
21
comment Are there any protocols that are truly secure from active and passive MITM attacks?
@tylo Thanks for your answer, regardless of the naysayers.
Nov
21
comment Are there any protocols that are truly secure from active and passive MITM attacks?
@fgrieu, but how do you get a trusted or true public key in the first place if you have no shared secret to verify the key you are receiving is authentic? If the attacker is at ISP level they can trivially replace any incoming public key with the attacker's key. How do two parties who have not communicated before verify that this is the true public key from the other person? Before you say CA, that doesn't work when NSLs exist or if your browser's trust chain is loaded with a few dodgy CA certificates.
Nov
21
comment Are there any protocols that are truly secure from active and passive MITM attacks?
@Gilles You can't rely on a CA to guarantee anything. Especially when a CA can be compromised or forced to hand over their certificate under a NSL. Exchanging the certificate beforehand is most beneficial however if loading it in your browser you still have to remove all the other stored certificates from the browser. Otherwise an attacker can sign the fake public key they are giving you with a compromised cert which is loaded in the browser trust chain then your browser silently accepts this. You need to pay attention to who signed the certificate and if the certificate changed recently.
Nov
21
comment Are there any protocols that are truly secure from active and passive MITM attacks?
Thanks for the paper link @rath.
Nov
21
comment Are there any protocols that are truly secure from active and passive MITM attacks?
@CPUTerminator, if that's true then why do people rely on CAs for authentication and still think SSL is safe?
Nov
8
comment Are there any protocols that are truly secure from active and passive MITM attacks?
@Gilles watch the full video I linked, it's very interesting. CA authentication is definitely not guaranteed in today's internet. Sure you could pre-share an SSL certificate beforehand in person. However if they start an active MITM attack then that throws up a big nasty warning in the browser, hence a denial of service. So my question is, what protocols prevent an active MITM attack and denial of service if a MITM detected?
Nov
8
comment Are there any protocols that are truly secure from active and passive MITM attacks?
@RickyDemer It's not quite a key. What's your protocol using a password? How do both Alice and Bob know it? Maybe that could work if it was a strong password (20+ chars?).
Nov
8
asked Are there any protocols that are truly secure from active and passive MITM attacks?