[Cryptography] Severe flaw in WPA2 protocol leaves Wi-Fi traffic open to eavesdropping

grarpamp grarpamp at gmail.com
Sun Oct 29 01:46:17 EDT 2017


On Sat, Oct 28, 2017 at 4:06 PM, Patrick Chkoreff
<patrick at rayservers.net> wrote:
> I forgot to mention that I am using a VPN, so THEY'd only be snooping on
> my quasi-random byte streams.

Since most people don't bother to pin down the far end VPN certs,
let alone confirm them out of band, and most networking does
not use DNSSEC, nor IP or MAC level authentication... yes,
they could MITM that do. And forgetting till now that it was limited
'private network traffic within their home', you know those
big homes that think nothing of dropping $400 on some closed
wifi gear so they can sext each other between far rooms / ends
that are autonegotiated by malfeasant wifi down to cleartext,
or simply terminate host as crypted and transport cleartext within,
all without getting up off their lazy duffs.

> All of that ... TODO

All of that, in said #Open* architectures is already handled
by sufficiently distributed, fully observed, documented,
reproducible, N-manned, any-partied, etc... so that you don't
have TODO anything other than satisfy yourself, or via
respected and multiple disparate reliance, that the process
is strong... and cough up the same $$$ or less for that instead.

Blind trust in corporate self assertions is fools errand.
Smoking doesn't cause cancer.
Drugs are safe.
Closed crypto is trusted.
...

Snakeoil still sells well, apparently.

Try asking them if you can remove the pretty wrapping paper,
or to send you the complete sources.


More information about the cryptography mailing list