Hacker News Reader

Comment by orblivion | Hacker News Reader

I'm not sure I understand the concern with breaking WiFi. Okay, so you're vulnerable to snooping and injection by people in the same coffee shop or your neighborhood. But you're already vulnerable to that from anybody on the Internet between you and the site. HTTPS solves both of these.

Am I missing something?

View on HN

There's a treasure-trove of data and metadata in your DNS requests, destination IP addresses, and traffic analysis. You're not just vulnerable to snooping either, but also traffic injection. You're exposing a much larger attack surface by losing the layer of security provided by WPA2.

Lots of sites aren't on https yet. Some never will be. Additionally there could be intranet communications no one bothered to secure, so maybe the company email's POP server was never configured to send text encrypted.

Yeah, Intranet is a good example.

In practice, the points where you're most susceptible to MITM/interception are the initiation and termination endpoints. Most of these connections terminate in a data center/hosting providers, which should generally have decent security and plenty of disincentives for snooping.

However, homes, coffee shops, airports, etc -- those are places where someone could execute this attack successfully.

You're right that any transit router could intercept your connection and do these things but in practice those routers are "reasonably" well secured.

I don't think that I have ever seen any colo-provider which did any meaningful monitoring of traffic on their datacenter-wide customer facing ethernet networks. Usually they struggle to sort out operational issuess caused by misconfigured customer hardware (eg. duplicate IPs or non-converging STP due to incompatible configuration of customer's switch), much less have capability do detect or even prevent targeted attack.

Security in layers, and because locally-hosted content may not always be sent over HTTPS (because people love to cut corners).

How encrypted is your average home network, really?

Yes, you miss ssl stripping.

Reply on news.ycombinator.com