Full Disclosure mailing list archives
Re: Python ssl handling could be better...
From: Tim <tim-security () sentinelchicken org>
Date: Wed, 2 Mar 2011 13:38:28 -0800
The list does go on. However, I completely disagree with your assertion that "O(MitM) = O(sniff)" Yes there are many vectors to MITM at many levels, but they are (perhaps not ALL) not only detectable but also preventable in many scenarios.* DNS cache poisoning => Don't fail at DNS * ARP poisoning => use static ARP tables (and before you say "who on earth does that"- I do) * routing protocol poisoning (many kinds) => (many solutions) * ICMP router redirects => Get filtered by firewall before they ever reach me * NETBIOS name poisoning => Don't ever use netbios for anythingThat should be fairly self-evident.
Ok great, but by comparing MitM with sniffing, we're already assuming the attacker has access to the traffic. Think about it. There aren't any networks in common use today which in their physical implementation make alteration of packets harder than observation of packets. This is why the big-Os are the same. I've had this conversation at many different times with different people over the years. I don't really have the time to continue this one. I think if you take the time to think about it from a theoretical perspective, you'll come to understand the solid arguments several of us are making. tim _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Python ssl handling could be better... Charles Morris (Mar 02)
- Re: Python ssl handling could be better... Tim (Mar 02)
- Re: Python ssl handling could be better... Charles Morris (Mar 02)
- Re: Python ssl handling could be better... Tim (Mar 02)
- Re: Python ssl handling could be better... Charles Morris (Mar 07)
- Re: Python ssl handling could be better... Valdis . Kletnieks (Mar 08)
- Re: Python ssl handling could be better... Charles Morris (Mar 02)
- Re: Python ssl handling could be better... Tim (Mar 02)
- Re: Python ssl handling could be better... Charles Morris (Mar 02)
- Re: Python ssl handling could be better... bk (Mar 02)
- Re: Python ssl handling could be better... Marsh Ray (Mar 03)
- Re: Python ssl handling could be better... Jeffrey Walton (Mar 03)
- <Possible follow-ups>
- Re: Python ssl handling could be better... Michael Krymson (Mar 04)
- Re: Python ssl handling could be better... bk (Mar 04)
- Re: Python ssl handling could be better... Marsh Ray (Mar 04)
- Re: Python ssl handling could be better... bk (Mar 04)