On Tue, Oct 26, 2010 at 8:11 PM, Lori Paniak <span dir="ltr"><<a href="mailto:ldpaniak@fourpisolutions.com">ldpaniak@fourpisolutions.com</a>></span> wrote:<br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div><div></div><div class="h5">On Tue, 2010-10-26 at 19:27 -0400, Khalid Baheyeldin wrote:<br>
> SSL requires that the site owner buys a certificate, which is an added<br>
> expense and effort to configure. It also requires that it be updated<br>
> manually every year. Yes, you can use self signed certificates, but<br>
> major browsers complain with a really scary<br>
> warning if you use those.<br>
<br></div></div></blockquote><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"><div><div class="h5">
> The other issue is that SSL on the server eats up a bit more CPU for<br>
> the encryption than plain text HTTP.<br>
><br>
> And it is one of these things that if everyone did it, all is well. If<br>
> a few major sites don't, then it is less than useful. Compare that to<br>
> PGP keys for signing emails. Only a few people use them.<br>
><br>
> Remember that HTTP is not the only traffic that you will do on a<br>
> typical desktop, or smartphone. If you are on IRC, or using Instant<br>
> Messaging (e.g. Jabber), then probably you are unencrypted too.<br>
><br>
> A VPN solves all this in one swoop, for an added performance penalty<br>
> (a little bit of CPU, plus the lag from/to the VPN) and perhaps added<br>
> expense too (either setup your own, or pay for a service).<br>
> --<br>
<br>
</div></div>I disagree. This is a structural problem that needs to be solved on the<br>
server end, not the client end. A little extra work and expense (less<br>
than the price of hosting?) is much less work and expense than each and<br>
every user stringing their own VPN proxy. Not to mention the users who<br>
don't know what VPN means. Maybe sites like Facebook should use their<br>
piles of cash to hire some people who know something about securing<br>
websites (like 2bits!).<br></blockquote><div><br>How would Facebook solving this for their own site solve it for the average<br>
user having his password sniffed when they connect to Gtalk via Jabber?<br>
<br></div><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Additional motivation for major sites to get their SSL act together<br>
would be boycotts of those that exchange credentials in clear text.<br></blockquote><div><br>Did that ever make the adoption of PGP for email pick up? Beyond us<br>geeks having key signing parties, it is barely known elsewhere.<br>
<br>Is it recognized by Yahoo Mail, Hotmail and Gmail?<br><br></div><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
The VPN solution is not going to be effective for real-time<br>
communications like VoIP or video (though there are other solutions<br>
there). Additionally, browsing the internet through your home VPN server<br>
is not particularly pleasant due to the <600kbps bottleneck on uploads<br>
from home.<br></blockquote><div><br>It is usable indeed.<br><br>Companies who provide VPN services are making good money providing<br>VPN services for those in countries that block Skype (e.g. UAE, Thailand,<br>and others).<br>
<br>I personally know a few people who use VPN just for that reason.<br><br>Yes, there is a performance penalty, but it does not make VoIP unusable.<br><br></div><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
I don't see eavesdropping on conversations as being (as big) a problem<br>
as stealing and spoofing ID. Having definite attribution is more<br>
important than content.<br></blockquote><div><br>That is the main issue: stealing credentials. That new Firefox extension<br>just make it so that any script kiddie can use it at any cafe or any university.<br> <br></div>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Bottom line: VPN is a band-aid that does not solve the underlying<br>
problem and just lets it get worse.<br></blockquote><div><br>If you are at home, on a secured WiFi or wired network, things are probably<br>OK. They have been for a while. The urgent need is open WiFi as an attack<br>vector for credentials that are sent over the wire.<br>
<br>A VPN solves this for both notebooks as well as smartphones in a cafe.<br> <br>Until all sites (and services) everywhere move to SSL that is ...<br><br></div><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Enough editorializing - time for a practical question: how secure is the<br>
kwlug site? How can it be improved? At what cost? (Sounds like a new<br>
thread)<br></blockquote></div><br>Yes, new thread.<br>-- <br>Khalid M. Baheyeldin<br><a href="http://2bits.com">2bits.com</a>, Inc.<br><a href="http://2bits.com">http://2bits.com</a><br>Drupal optimization, development, customization and consulting.<br>
Simplicity is prerequisite for reliability. -- Edsger W.Dijkstra<br>Simplicity is the ultimate sophistication. -- Leonardo da Vinci<br>