6 ms·

Where do you detect malice? The claims are quite accurate.

by f_devd 10mo ago

drtgh 10mo ago
Accurate? Lets take the Wifi (Other users already commented the other ones). Open a wifi access point with the name of the restaurant, intercept the DNS requests and serve your filtered stuff. PS: If the text is real and not trolling, the keyword in the text is 'rarely happen', which we could apply to car seatbelts then.
- jrjfjgkrj 10mo ago
  what filtered stuff? you mean partial web pages? most browsers use DNS over HTTPS
- johncoatesdev 10mo ago
  And how exactly do you plan to forge the SSL certificates to deliver your filtered contents?
- quesera 10mo ago
  > intercept the DNS requests and serve your filtered stuff. How do you get from a malicious DNS response to a browser-validated TLS cert for the requested host?
- 8organicbits 10mo ago
  Then what? The user presumably sees TLS certificate warnings since you don't have valid certicates. HSTS would prevent downgrades to plain HTTP and is pretty common on sensitive websites. Isn't the better advice to avoid clicking through certificate warnings? That applies both on and off open wifi networks. There is a privacy concern, as DNS queries would leak. Enabling strict DoH helps (which is not the default browser setting).
  - drtgh 10mo ago
    I am afraid that it is not only about privacy (that they recommend ignoring), there are many options to chose, like CA vectors, lets say TrustCor (2022), e-Tugra (2023), Entrust (2024), Packet injection vectors, or Click here or use your login first vectors as you commented, bugs and configurations. This ones known. Therefore I just cannot believe that those who wrote the open letter did not even though about such significant events from the past year, I remark the past year, or even on zero-days. We are talking about people connecting to an unknown unsupervised network, that we do not know what new vulnerabilities will be published on main stream also, and the ones of the open letter know it because they are hiding behind the excuse of "rarely".
    - 8organicbits 10mo ago
      > like CA vectors This gets complicated because you're not safe on your home or corporate network either when CAs are breached. The incident everyone talks about, DigiNotar (2011), had stolen CA keys issuing certificates that intercepted traffic across several ISPs. If that's the threat you're looking to handle, "avoid public wifi" isn't the right answer. Perhaps you're doing certificate pinning, application level signing, closed networks, etc. > Entrust (2024) I recently wrote a blog post[1] about CA incidents, so I notice this one isn't like the others. Entrust's PKI business was not impacted by the hack and Entrust remains a trusted CA. > Click here or use your login Password manager autofill is the solution there, both on public wifi and on a corporate network. Perhaps an ad blocker as well. > people connecting to an unknown unsupervised network Aren't most people's home networks "unsupervised"? [1] https://alexsci.com/blog/ca-trust/ https://alexsci.com/blog/ca-trust/
      - drtgh 10mo ago
        Why do you talk about home networks "unsupervised" when we are talking about public networks, access points, created to hunt people? Do you notice that your proposed solutions try to fix a problem, isn't it? The open letter does not propose solutions; it merely denies them. It is needed to be sincere with people, those "incidents" have happened for a long time, and unfortunately will keep happening (given the history), bad actors hunting, yesterday the CAs, and tomorrow? So if one connect to an open wifi one may fall victim to a trap, probably not at home but in an Airport or other crowded places with long waits, and even if you do not browse another app in background will be trying to do it. It was needed many years to make people just sightly aware, and now they -if the text is real- pretend to undo it. But to be sincere I really do not mind much, I just perceive that open letter as malicious.

Where do you detect malice? The claims are quite accurate.

by f_devd 10mo ago

Where do you detect malice? The claims are quite accurate.

drtgh 10mo ago

Accurate? Lets take the Wifi (Other users already commented the other ones). Open a wifi access point with the name of the restaurant, intercept the DNS requests and serve your filtered stuff. PS: If the text is real and not trolling, the keyword in the text is 'rarely happen', which we could apply to car seatbelts then.

jrjfjgkrj 10mo ago
what filtered stuff? you mean partial web pages? most browsers use DNS over HTTPS
johncoatesdev 10mo ago
And how exactly do you plan to forge the SSL certificates to deliver your filtered contents?
quesera 10mo ago
> intercept the DNS requests and serve your filtered stuff. How do you get from a malicious DNS response to a browser-validated TLS cert for the requested host?
8organicbits 10mo ago
Then what? The user presumably sees TLS certificate warnings since you don't have valid certicates. HSTS would prevent downgrades to plain HTTP and is pretty common on sensitive websites. Isn't the better advice to avoid clicking through certificate warnings? That applies both on and off open wifi networks. There is a privacy concern, as DNS queries would leak. Enabling strict DoH helps (which is not the default browser setting).
- drtgh 10mo ago
  I am afraid that it is not only about privacy (that they recommend ignoring), there are many options to chose, like CA vectors, lets say TrustCor (2022), e-Tugra (2023), Entrust (2024), Packet injection vectors, or Click here or use your login first vectors as you commented, bugs and configurations. This ones known. Therefore I just cannot believe that those who wrote the open letter did not even though about such significant events from the past year, I remark the past year, or even on zero-days. We are talking about people connecting to an unknown unsupervised network, that we do not know what new vulnerabilities will be published on main stream also, and the ones of the open letter know it because they are hiding behind the excuse of "rarely".
  - 8organicbits 10mo ago
    > like CA vectors This gets complicated because you're not safe on your home or corporate network either when CAs are breached. The incident everyone talks about, DigiNotar (2011), had stolen CA keys issuing certificates that intercepted traffic across several ISPs. If that's the threat you're looking to handle, "avoid public wifi" isn't the right answer. Perhaps you're doing certificate pinning, application level signing, closed networks, etc. > Entrust (2024) I recently wrote a blog post[1] about CA incidents, so I notice this one isn't like the others. Entrust's PKI business was not impacted by the hack and Entrust remains a trusted CA. > Click here or use your login Password manager autofill is the solution there, both on public wifi and on a corporate network. Perhaps an ad blocker as well. > people connecting to an unknown unsupervised network Aren't most people's home networks "unsupervised"? [1] https://alexsci.com/blog/ca-trust/ https://alexsci.com/blog/ca-trust/
    - drtgh 10mo ago
      Why do you talk about home networks "unsupervised" when we are talking about public networks, access points, created to hunt people? Do you notice that your proposed solutions try to fix a problem, isn't it? The open letter does not propose solutions; it merely denies them. It is needed to be sincere with people, those "incidents" have happened for a long time, and unfortunately will keep happening (given the history), bad actors hunting, yesterday the CAs, and tomorrow? So if one connect to an open wifi one may fall victim to a trap, probably not at home but in an Airport or other crowded places with long waits, and even if you do not browse another app in background will be trying to do it. It was needed many years to make people just sightly aware, and now they -if the text is real- pretend to undo it. But to be sincere I really do not mind much, I just perceive that open letter as malicious.