On 18/03/12 04:28 AM, Kevin Chadwick wrote:
On Sat, 17 Mar 2012 14:56:18 +1100
ianG wrote:
No, that assumes the attacker is waiting and intercepting every web
server request. In practice, he is not.
This should be assumed
Now we're getting into real detailed questions. The answer is: at a
threat modelling level, MITM exists. At a risk modelling level, we
haven't decided yet whether it is a worry or not. We could decide it is
not a worry and accept it (SSH). Or we could decide that it is a worry
and decide to address it as our #1 threat (SSL).
The thing to do here is realise that we haven't really settled enough of
the architecture to answer these questions. For example, if code
signing is the biggest thing, then MITM is likely less of a worry. If
super-secure-stores are our great white hope, then MITM might be more of
an issue. Wait and see.
and should not matter especially as GSM is so
easily decrypted, coupled with a rogue CA makes gpg or atleast a
mozilla CA far far far more appropriate.
GSM is one of my favourite examples :) It was broken by Lucky Green
back in ... 1997? And, there was no outbreak of MITMing until .. when?
Sometime around the late 00s devices appeared on the market that could
do cracks in real time or near real time. There's still no outbreak or
even documented occurances to my knowledge.
What did the GSM consortium decide to do? In 1997?
Accept the risk.
Right decision - if you know what their threat model was: papparazzi and
minute thieves.
iang
PS: or 1997? I had the very good fortune to be able to convince Lucky
to come and present the crack to the smart card money security group I
worked with at that time ... who'd mostly transferred over from the
local telco, and had really researched the GSM model properly. These
guys were one of the 6 telcos to change the algorithms, if you know what
that means. It was a fascinating lesson in mindsets and how security
models tended to feed on themselves. Self-validation was the norm,
something John Boyd called "spinning in your own loop."
_______________________________________________
dev-security mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security
