Ian G wrote:
Bob Relyea wrote:
yes it does. If you can't trust you've made a connection to the site you thought you made a connection to, you have no security. Saying you do is like saying "I'm secure because I have an RF shielded cable running from my computer".
Hmm... people trust to probabilities every minute of their lives. They may not have "security" but they have a great chance of surviving. Just because there is small chance of losing that bet doesn't mean that we can then turn around and say "that's not secure."
That's true, but without authentication, they are getting little or no additional security.
<begin SOAPBOX>
When people say SSH secures them, they mean it in the same way that they say seatbelts secure them, and cars secure them and stocks and bonds are securities.
You missed the point. People think SSH secures them the way seatbelts do, but it's more like using bailing twine... It may hold you in an accident, it may slice through you as well. Because your chances of being in an accident is small, you don't notice the difference between real seatbelts and bailing twine... but then you wouldn't notice the difference between bailing twine and no seat belts what-so-ever either.
My point was that the difference in the risk difference in the risk of using encryption without strongly authenticating and not using encryption at all is much smaller than most people believe. For most point to point applications it turns out not to be a big issue because you are typically run the risk once when you accept the anonymous credential and subsequent connections are effectively authenticated. If you are making multiple connections (such as surfing to SSL web sites), you are at pretty much the same risk whether or not you use encryption.
This point was not lost on the builders of such tools as SSH and PGP. The ability to do strong authentication was built in. Both of these products warn when encountering an new and untrusted key. It was expected that you as a user would then authenticate the key. In practice even intellegent people did not know what that means, and now blithely assume that because the connection is encrypted they are significantly more secure (which they are not).
It's true the novice thief may pass up the gate because it is too much work to get through, but even a casual thief would recognize the lock as fake and break in. If the user had known the lock was fake, he may not have secured his valuables behind it.
Right. Tell the user how much security there is.
I think that's the point. If the channel is unauthenticated, it's additional security through encryption is negligible.
bob
smime.p7s
Description: S/MIME Cryptographic Signature
