I'd like to get rid of pulseaudio but ... (Gene Heskett)

Bruno Wolff III bruno at wolff.to
Tue Jun 2 05:35:04 UTC 2009


On Mon, Jun 01, 2009 at 14:01:54 -0500,
  Chris Adams <cmadams at hiwaay.net> wrote:
> 
> ISTR if you can snoop you can hijack the TCP session setup by responding
> first (aren't out-of-window packets ignored?).  You don't have to cause
> the "real" responses to be dropped, you just have to respond faster.

That's still an active attack. You have to be able to see the incoming packets
and try to send replies back fast. You need to be doing this from some
place that doesn't do proper egress filtering or very close to the destination.
This is still hard to do broadly, unlike being able to peruse through all of
the traffic that goes through major exchange points on the internet.

> > And be sure to note that certificate signed by RSA, Thawte or whoever doesn't
> > equate to secure either. Unless you have verified the end certificate
> > yourself you don't know that the organization on the other end is who you
> > really mean to be talking to.
> 
> You are trusting that the CAs have done the verification, which they do
> (to differing degrees).

They don't have a way to verify that the site I am going to is the one I
mean to. It isn't that hard to trick someone to going to a valid https
site, that isn't really the one they mean to. And Firefox doesn't try to
help with this case at all.

The whole hierarchical design is a bad fit for what it is trying to do.
Web of trust would be a lot better. But even with the current system the
Firefox UI could do more to help people notice changes.




More information about the fedora-list mailing list