Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.sys.mac.system > #56833 > unrolled thread
| Started by | Ted Lee <tmplee@gmail.com> |
|---|---|
| First post | 2014-02-22 12:56 -0600 |
| Last post | 2014-03-01 21:53 +0000 |
| Articles | 20 on this page of 197 — 21 participants |
Back to article view | Back to comp.sys.mac.system
Latest IOS/OS X SSL security flaw Ted Lee <tmplee@gmail.com> - 2014-02-22 12:56 -0600
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-02-22 14:15 -0500
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-22 14:47 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-22 21:30 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-22 19:04 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-23 00:36 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 09:48 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-23 16:41 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 12:05 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-23 17:22 +0000
Re: Latest IOS/OS X SSL security flaw billy@MIX.COM - 2014-02-24 02:15 +0000
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-24 03:57 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 18:25 -0500
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-25 08:16 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-25 19:50 -0500
Re: Latest IOS/OS X SSL security flaw Don Bruder <dakidd@sonic.net> - 2014-02-23 07:51 -0800
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 11:23 -0500
Re: Latest IOS/OS X SSL security flaw Don Bruder <dakidd@sonic.net> - 2014-02-23 15:05 -0800
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 20:01 -0500
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-24 04:21 +0000
Re: Latest IOS/OS X SSL security flaw Bill Findlay <yaldnif.w@blueyonder.co.uk> - 2014-02-24 04:35 +0000
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-24 06:00 +0000
Re: Latest IOS/OS X SSL security flaw JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-02-24 16:52 -0500
Re: Latest IOS/OS X SSL security flaw Bill Findlay <yaldnif.w@blueyonder.co.uk> - 2014-02-24 21:54 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 17:44 -0500
Re: Latest IOS/OS X SSL security flaw Bill Findlay <yaldnif.w@blueyonder.co.uk> - 2014-02-25 00:19 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 19:26 -0500
Re: Latest IOS/OS X SSL security flaw Bill Findlay <yaldnif.w@blueyonder.co.uk> - 2014-02-25 00:40 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 19:46 -0500
Re: Latest IOS/OS X SSL security flaw Bill Findlay <yaldnif.w@blueyonder.co.uk> - 2014-02-25 00:57 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 17:43 -0500
Re: Latest IOS/OS X SSL security flaw Bill Findlay <yaldnif.w@blueyonder.co.uk> - 2014-02-25 00:19 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 19:29 -0500
Re: Latest IOS/OS X SSL security flaw Bill Findlay <yaldnif.w@blueyonder.co.uk> - 2014-02-25 00:40 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 19:45 -0500
Re: Latest IOS/OS X SSL security flaw Bill Findlay <yaldnif.w@blueyonder.co.uk> - 2014-02-25 00:57 +0000
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-24 05:04 +0000
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-24 06:00 +0000
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-24 16:10 +0000
Re: Latest IOS/OS X SSL security flaw Kurt Ullman <kurtullman@yahoo.com> - 2014-02-24 12:15 -0500
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-24 22:33 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 17:47 -0500
Re: Latest IOS/OS X SSL security flaw Richard Kettlewell <rjk@greenend.org.uk> - 2014-02-25 13:41 +0000
Re: Latest IOS/OS X SSL security flaw Kurt Ullman <kurtullman@yahoo.com> - 2014-02-25 09:06 -0500
Re: Latest IOS/OS X SSL security flaw billy@MIX.COM - 2014-02-25 17:34 +0000
Re: Latest IOS/OS X SSL security flaw billy@MIX.COM - 2014-02-25 19:14 +0000
Re: Latest IOS/OS X SSL security flaw Paul Sture <nospam@sture.ch> - 2014-02-25 20:42 +0100
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-25 21:32 +0000
Re: Latest IOS/OS X SSL security flaw Ted Lee <tmplee@gmail.com> - 2014-02-25 17:12 -0600
Re: Latest IOS/OS X SSL security flaw Ted Lee <tmplee@gmail.com> - 2014-02-25 17:24 -0600
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-26 02:38 +0000
Re: Latest IOS/OS X SSL security flaw Ted Lee <tmplee@gmail.com> - 2014-02-25 21:03 -0600
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-26 04:19 +0000
Re: Latest IOS/OS X SSL security flaw "M. John Matlaw" <nouser@invalid.com> - 2014-02-28 11:29 -0500
Re: Latest IOS/OS X SSL security flaw Ted Lee <tmplee@gmail.com> - 2014-02-28 12:48 -0600
Re: Latest IOS/OS X SSL security flaw billy@MIX.COM - 2014-02-26 01:44 +0000
Re: Latest IOS/OS X SSL security flaw billy@MIX.COM - 2014-02-25 21:59 +0000
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-24 22:33 +0000
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-24 23:13 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 17:45 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-24 23:17 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 18:28 -0500
Re: Latest IOS/OS X SSL security flaw JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-02-24 23:16 -0500
Re: Latest IOS/OS X SSL security flaw Don Bruder <dakidd@sonic.net> - 2014-02-24 21:17 -0800
Re: Latest IOS/OS X SSL security flaw Paul Sture <nospam@sture.ch> - 2014-02-25 21:03 +0100
Re: Latest IOS/OS X SSL security flaw Paul Sture <nospam@sture.ch> - 2014-02-25 21:00 +0100
Re: Latest IOS/OS X SSL security flaw billy@MIX.COM - 2014-02-25 22:02 +0000
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-25 08:11 +0000
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-25 16:47 +0000
Re: Latest IOS/OS X SSL security flaw JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-02-25 17:03 -0500
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-25 19:45 -0500
Re: Latest IOS/OS X SSL security flaw JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-02-26 00:05 -0500
Re: Latest IOS/OS X SSL security flaw Paul Sture <nospam@sture.ch> - 2014-02-25 20:57 +0100
Re: Latest IOS/OS X SSL security flaw "M. John Matlaw" <nouser@invalid.com> - 2014-02-26 09:52 -0500
Re: Latest IOS/OS X SSL security flaw Paul Sture <nospam@sture.ch> - 2014-04-06 02:36 +0200
Re: Latest IOS/OS X SSL security flaw Paul Sture <nospam@sture.ch> - 2014-02-24 21:24 +0100
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-24 20:43 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 17:40 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-23 16:47 +0000
Re: Latest IOS/OS X SSL security flaw Don Bruder <dakidd@sonic.net> - 2014-02-23 15:37 -0800
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 20:08 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-24 01:15 +0000
Re: Latest IOS/OS X SSL security flaw Don Bruder <dakidd@sonic.net> - 2014-02-23 18:45 -0800
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-24 02:52 +0000
Re: Latest IOS/OS X SSL security flaw Don Bruder <dakidd@sonic.net> - 2014-02-23 19:01 -0800
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-24 04:23 +0000
Re: Latest IOS/OS X SSL security flaw Paul Sture <nospam@sture.ch> - 2014-02-24 22:10 +0100
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-24 22:21 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 17:27 -0500
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 17:27 -0500
Re: Latest IOS/OS X SSL security flaw Don Bruder <dakidd@sonic.net> - 2014-02-24 21:05 -0800
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-25 19:34 -0500
Re: Latest IOS/OS X SSL security flaw Paul Sture <nospam@sture.ch> - 2014-02-24 21:58 +0100
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 18:04 -0500
Re: Latest IOS/OS X SSL security flaw billy@MIX.COM - 2014-02-25 02:44 +0000
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-24 01:14 +0000
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-24 04:11 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 18:36 -0500
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-25 08:20 +0000
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-25 17:00 +0000
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-25 20:05 +0000
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-25 21:31 +0000
Re: Latest IOS/OS X SSL security flaw Don Bruder <dakidd@sonic.net> - 2014-02-25 19:13 -0800
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-26 04:35 +0000
Re: Latest IOS/OS X SSL security flaw billy@MIX.COM - 2014-02-26 06:42 +0000
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-03-01 21:57 +0000
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-26 23:29 +0000
Re: Latest IOS/OS X SSL security flaw Walter Bushell <proto@panix.com> - 2014-04-13 15:06 -0400
Re: Latest IOS/OS X SSL security flaw Tom Stiller <clusterfux.upmon@gmail.com> - 2014-04-13 21:11 +0000
Re: Latest IOS/OS X SSL security flaw Walter Bushell <proto@panix.com> - 2014-04-15 17:03 -0400
Re: Latest IOS/OS X SSL security flaw Your Name <YourName@YourISP.com> - 2014-04-16 09:29 +1200
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-25 19:29 -0500
Re: Latest IOS/OS X SSL security flaw Bill Findlay <yaldnif.w@blueyonder.co.uk> - 2014-02-26 00:49 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-25 19:59 -0500
Re: Latest IOS/OS X SSL security flaw Bill Findlay <yaldnif.w@blueyonder.co.uk> - 2014-02-26 02:03 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-25 22:13 -0500
Re: Latest IOS/OS X SSL security flaw Bill Findlay <yaldnif.w@blueyonder.co.uk> - 2014-02-26 14:03 +0000
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-26 23:42 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-27 17:03 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-26 02:47 +0000
Re: Latest IOS/OS X SSL security flaw JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-02-26 00:10 -0500
Re: Latest IOS/OS X SSL security flaw Walter Bushell <proto@panix.com> - 2014-04-13 15:11 -0400
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-04-13 15:43 -0400
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-26 02:42 +0000
Re: Latest IOS/OS X SSL security flaw Walter Bushell <proto@panix.com> - 2014-04-13 15:08 -0400
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-04-13 15:41 -0400
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-25 19:18 -0500
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-26 23:39 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-27 17:09 -0500
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 13:03 -0500
Re: Latest IOS/OS X SSL security flaw Bill Findlay <yaldnif.w@blueyonder.co.uk> - 2014-02-23 01:32 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 10:07 -0500
Re: Latest IOS/OS X SSL security flaw Paul Sture <nospam@sture.ch> - 2014-04-06 02:44 +0200
Re: Latest IOS/OS X SSL security flaw JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-02-22 17:49 -0500
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-22 19:07 -0500
Re: Latest IOS/OS X SSL security flaw JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-02-22 22:23 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-23 03:49 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 10:12 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-23 16:42 +0000
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-02-23 14:38 -0500
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 10:11 -0500
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-02-23 14:38 -0500
Re: Latest IOS/OS X SSL security flaw Jim Gibson <jimsgibson@gmail.com> - 2014-02-24 10:42 -0800
Re: Latest IOS/OS X SSL security flaw JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-02-24 17:07 -0500
Re: Latest IOS/OS X SSL security flaw Kevin McMurtrie <mcmurtrie@pixelmemory.us> - 2014-02-22 23:01 -0800
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-02-23 14:38 -0500
Re: Latest IOS/OS X SSL security flaw billy@MIX.COM - 2014-02-24 01:46 +0000
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-03-01 21:52 +0000
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-03-02 00:05 -0500
Re: Latest IOS/OS X SSL security flaw Paul Sture <nospam@sture.ch> - 2014-02-24 22:24 +0100
Re: Latest IOS/OS X SSL security flaw mcarels@xs4all.nl (Maarten Carels) - 2014-02-24 10:43 +0100
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 18:39 -0500
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 19:16 -0500
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-22 14:18 -0500
Re: Latest IOS/OS X SSL security flaw Tim McNamara <timmcn@bitstream.net> - 2014-02-22 13:43 -0600
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-22 14:52 -0500
Re: Latest IOS/OS X SSL security flaw Richard Kettlewell <rjk@greenend.org.uk> - 2014-02-22 20:05 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-22 15:16 -0500
Re: Latest IOS/OS X SSL security flaw Richard Kettlewell <rjk@greenend.org.uk> - 2014-02-22 21:10 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-22 16:25 -0500
Re: Latest IOS/OS X SSL security flaw Richard Kettlewell <rjk@greenend.org.uk> - 2014-02-22 22:13 +0000
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-22 22:19 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-22 18:55 -0500
Re: Latest IOS/OS X SSL security flaw Richard Kettlewell <rjk@greenend.org.uk> - 2014-02-23 09:38 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 10:17 -0500
Re: Latest IOS/OS X SSL security flaw Richard Kettlewell <rjk@greenend.org.uk> - 2014-02-23 15:42 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 10:45 -0500
Re: Latest IOS/OS X SSL security flaw Richard Kettlewell <rjk@greenend.org.uk> - 2014-02-23 17:09 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 13:51 -0500
Re: Latest IOS/OS X SSL security flaw Richard Kettlewell <rjk@greenend.org.uk> - 2014-02-23 20:07 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 15:14 -0500
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 15:20 -0500
Re: Latest IOS/OS X SSL security flaw billy@MIX.COM - 2014-02-24 02:18 +0000
Re: Latest IOS/OS X SSL security flaw JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-02-22 17:51 -0500
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-02-22 17:55 -0500
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-22 21:50 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-22 19:09 -0500
Re: Latest IOS/OS X SSL security flaw Alan Baker <alangbaker@telus.net> - 2014-02-22 12:35 -0800
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-02-22 16:59 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-22 22:14 +0000
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-02-22 17:53 -0500
Re: Latest IOS/OS X SSL security flaw JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-02-22 18:01 -0500
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-02-22 18:22 -0500
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-02-22 18:29 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-22 23:33 +0000
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-02-23 18:23 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-24 01:08 +0000
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-22 21:49 +0000
Re: Latest IOS/OS X SSL security flaw Kevin McMurtrie <mcmurtrie@pixelmemory.us> - 2014-02-22 22:57 -0800
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-23 16:36 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 11:58 -0500
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-02-23 14:35 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-23 21:03 +0000
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-02-23 18:23 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-24 01:07 +0000
Re: Latest IOS/OS X SSL security flaw billy@MIX.COM - 2014-02-24 01:53 +0000
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-03-01 21:53 +0000
Page 8 of 10 — ← Prev page 1 … 6 7 [8] 9 10 Next page →
| From | Alan Browne <alan.browne@FreelunchVideotron.ca> |
|---|---|
| Date | 2014-02-23 10:11 -0500 |
| Message-ID | <3tmdnWP8_v0tkpfOnZ2dnUVZ_rGdnZ2d@giganews.com> |
| In reply to | #56878 |
On 2014.02.22, 22:23 , JF Mezei wrote:
> On 14-02-22 19:07, Alan Browne wrote:
>
>> Compiler optimization doesn't replace source code.
>
> Modern commercial optimizing compilers most certaintly do. They also
> re-arrange order for some target platforms.
First off, I mis-interpreted what you meant. You're correct that
optimizers will change code - but NEVER change the SOURCE code (file).
They may produce warnings too, of course depending on pragmas.
In the case at hand, however, the optimizer would not want to change the
code that caused the bug. But it would have eliminated the subsequent
tests down to the label "fail" resulting in functionally equivalent code.
--
Privacy has become an essential personal chore that most
people are not trained to perform.
- Jaron Lanier, Scientific American, 2013.11.
[toc] | [prev] | [next] | [standalone]
| From | nospam <nospam@nospam.invalid> |
|---|---|
| Date | 2014-02-23 14:38 -0500 |
| Message-ID | <230220141438539377%nospam@nospam.invalid> |
| In reply to | #56878 |
In article <5309699e$0$34974$c3e8da3$460562f1@news.astraweb.com>, JF Mezei <jfmezei.spamnot@vaxination.ca> wrote: > There is nothing wrong with the code. there definitely is.
[toc] | [prev] | [next] | [standalone]
| From | Jim Gibson <jimsgibson@gmail.com> |
|---|---|
| Date | 2014-02-24 10:42 -0800 |
| Message-ID | <240220141042041401%jimsgibson@gmail.com> |
| In reply to | #56878 |
In article <5309699e$0$34974$c3e8da3$460562f1@news.astraweb.com>, JF Mezei <jfmezei.spamnot@vaxination.ca> wrote: > On 14-02-22 19:07, Alan Browne wrote: > > > Compiler optimization doesn't replace source code. > > Modern commercial optimizing compilers most certaintly do. They also > re-arrange order for some target platforms. > > A whole block of IFs whose sole outcome is to branch to the same place > would be detected by a good compiler and optimized away. Not if evaluating the expressions for the IF statements have side-effects. Optimizing those away would change the state of the program. -- Jim Gibson
[toc] | [prev] | [next] | [standalone]
| From | JF Mezei <jfmezei.spamnot@vaxination.ca> |
|---|---|
| Date | 2014-02-24 17:07 -0500 |
| Message-ID | <530bc2b3$0$50770$c3e8da3$92d0a893@news.astraweb.com> |
| In reply to | #56975 |
On 14-02-24 13:42, Jim Gibson wrote: > Not if evaluating the expressions for the IF statements have > side-effects. Optimizing those away would change the state of the > program. And that is why optimizing compilers are very good at examining if there are side effects which cannot be optimized away. (for instance, if the if statement calls a subroutine and evaluates its return value, it can't be optimized away since the compiler won't know what the subroutine does.)
[toc] | [prev] | [next] | [standalone]
| From | Kevin McMurtrie <mcmurtrie@pixelmemory.us> |
|---|---|
| Date | 2014-02-22 23:01 -0800 |
| Message-ID | <mcmurtrie-1A4D17.23011222022014@c-61-68-245-199.per.connect.net.au> |
| In reply to | #56861 |
In article <53092980$0$9676$c3e8da3$aae71a0a@news.astraweb.com>, JF Mezei <jfmezei.spamnot@vaxination.ca> wrote: > On 14-02-22 14:47, Alan Browne wrote: > > > goto has always been a source of low software quality - and it rears its > > head again here - although it looks more like sloppy editing than > > anything else - like another line of condition code had been deleted or > > moved. > > > Don't forget compiler optimisation which may have replaced all that code > with a "goto fail" since in every situation, the only action taken is to > goto fail. The first two conditions can not be optimized away because they influence the return value. The code after the extra goto must be removed, and that should have generated a warning.
[toc] | [prev] | [next] | [standalone]
| From | nospam <nospam@nospam.invalid> |
|---|---|
| Date | 2014-02-23 14:38 -0500 |
| Message-ID | <230220141438529316%nospam@nospam.invalid> |
| In reply to | #56885 |
In article <mcmurtrie-1A4D17.23011222022014@c-61-68-245-199.per.connect.net.au>, Kevin McMurtrie <mcmurtrie@pixelmemory.us> wrote: > The first two conditions can not be optimized away because they > influence the return value. The code after the extra goto must be > removed, and that should have generated a warning. it does. someone i know compiled an equivalent test app and xcode issue a warning, which means the warning must have been ignored (or the compiler was set to skip that check which is equally bad).
[toc] | [prev] | [next] | [standalone]
| From | billy@MIX.COM |
|---|---|
| Date | 2014-02-24 01:46 +0000 |
| Message-ID | <lee895$7u8$1@reader2.panix.com> |
| In reply to | #56916 |
nospam <nospam@nospam.invalid> writes, quoting
Kevin McMurtrie <mcmurtrie@pixelmemory.us>:
> > The first two conditions can not be optimized away because they
> > influence the return value. The code after the extra goto must be
> > removed, and that should have generated a warning.
>
> it does. someone i know compiled an equivalent test app and xcode issue
Equivalent test? Any idiot (even you) could have grabbed the actual module
http://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslKeyExchange.c
and ran a real test. The unfixed version is still there, by the way.
> a warning, which means the warning must have been ignored (or the
> compiler was set to skip that check which is equally bad).
From Adam Langley -
| If I compile with -Wall (enable all warnings), neither GCC 4.8.2 or
| Clang 3.3 from Xcode make a peep about the dead code. That's surprising
| to me. A better warning could have stopped this but perhaps the false
| positive rate is too high over real codebases? (Thanks to Peter Nelson
| for pointing out the Clang does have -Wunreachable-code to warn about
| this, but it's not in -Wall.)
Billy Y..
--
sub #'9+1 ,r0 ; convert ascii byte
add #9.+1 ,r0 ; to an integer
bcc 20$ ; not a number
[toc] | [prev] | [next] | [standalone]
| From | Jolly Roger <jollyroger@pobox.com> |
|---|---|
| Date | 2014-03-01 21:52 +0000 |
| Message-ID | <bnf34tFl9faU1@mid.individual.net> |
| In reply to | #57302 |
On 2014-02-24, billy@MIX.COM <billy@MIX.COM> wrote: > nospam <nospam@nospam.invalid> writes, quoting > Kevin McMurtrie <mcmurtrie@pixelmemory.us>: > >> > The first two conditions can not be optimized away because they >> > influence the return value. The code after the extra goto must be >> > removed, and that should have generated a warning. >> >> it does. someone i know compiled an equivalent test app and xcode issue > > Equivalent test? Any idiot (even you) could have grabbed the actual module > > http://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslKeyExchange.c > > and ran a real test. The unfixed version is still there, by the way. > >> a warning, which means the warning must have been ignored (or the >> compiler was set to skip that check which is equally bad). > > From Adam Langley - > >| If I compile with -Wall (enable all warnings), neither GCC 4.8.2 or >| Clang 3.3 from Xcode make a peep about the dead code. That's surprising >| to me. A better warning could have stopped this but perhaps the false >| positive rate is too high over real codebases? (Thanks to Peter Nelson >| for pointing out the Clang does have -Wunreachable-code to warn about >| this, but it's not in -Wall.) > > Billy Y.. As I suspected. Don't expect mr.know-it-all to admit he's wrong though. It simply will not happen. -- E-mail sent to this address may be devoured by my ravenous SPAM filter. I often ignore posts from Google. Use a real news client instead. JR
[toc] | [prev] | [next] | [standalone]
| From | nospam <nospam@nospam.invalid> |
|---|---|
| Date | 2014-03-02 00:05 -0500 |
| Message-ID | <020320140005332056%nospam@nospam.invalid> |
| In reply to | #57317 |
In article <bnf34tFl9faU1@mid.individual.net>, Jolly Roger <jollyroger@pobox.com> wrote: > >> > The first two conditions can not be optimized away because they > >> > influence the return value. The code after the extra goto must be > >> > removed, and that should have generated a warning. > >> > >> it does. someone i know compiled an equivalent test app and xcode issue > > > > Equivalent test? Any idiot (even you) could have grabbed the actual module > > > > http://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/l > > ib/sslKeyExchange.c > > > > and ran a real test. The unfixed version is still there, by the way. > > > >> a warning, which means the warning must have been ignored (or the > >> compiler was set to skip that check which is equally bad). > > > > From Adam Langley - > > > >| If I compile with -Wall (enable all warnings), neither GCC 4.8.2 or > >| Clang 3.3 from Xcode make a peep about the dead code. That's surprising > >| to me. A better warning could have stopped this but perhaps the false > >| positive rate is too high over real codebases? (Thanks to Peter Nelson > >| for pointing out the Clang does have -Wunreachable-code to warn about > >| this, but it's not in -Wall.) > > As I suspected. Don't expect mr.know-it-all to admit he's wrong though. > It simply will not happen. there's nothing to admit since nothing is wrong. xcode catches the error. this is a *fact*, despite your claims to the contrary and anyone who says otherwise is lying. obviously, it's possible to have warnings off, which is why i specifically mentioned that possibility. the fact you intentionally ignored what i wrote shows just how much of a lying troll you really are. if apple is building code with warnings off, particularly security related code, then that's a sign of a much bigger and more serious problem. and even if that code did somehow manage to slip through somehow, it should have been caught in a code review and/or testing, which they apparently did not do either.
[toc] | [prev] | [next] | [standalone]
| From | Paul Sture <nospam@sture.ch> |
|---|---|
| Date | 2014-02-24 22:24 +0100 |
| Message-ID | <dtpsta-ic81.ln1@news.chingola.ch> |
| In reply to | #56885 |
On 2014-02-23, Kevin McMurtrie <mcmurtrie@pixelmemory.us> wrote: > In article <53092980$0$9676$c3e8da3$aae71a0a@news.astraweb.com>, > JF Mezei <jfmezei.spamnot@vaxination.ca> wrote: > >> On 14-02-22 14:47, Alan Browne wrote: >> >> > goto has always been a source of low software quality - and it rears its >> > head again here - although it looks more like sloppy editing than >> > anything else - like another line of condition code had been deleted or >> > moved. >> >> >> Don't forget compiler optimisation which may have replaced all that code >> with a "goto fail" since in every situation, the only action taken is to >> goto fail. > > The first two conditions can not be optimized away because they > influence the return value. The code after the extra goto must be > removed, and that should have generated a warning. Even good old fashioned non-optimising COBOL would have caught this error, flagging everything after the offending goto as "unreachable code". -- Paul Sture
[toc] | [prev] | [next] | [standalone]
| From | mcarels@xs4all.nl (Maarten Carels) |
|---|---|
| Date | 2014-02-24 10:43 +0100 |
| Message-ID | <1lhkhhc.1yh45lb19qxj8eN%mcarels@xs4all.nl> |
| In reply to | #56837 |
Alan Browne <alan.browne@FreelunchVideotron.ca> wrote: > On 2014.02.22, 14:15 , nospam wrote: > > In article <lears8$l8d$1@dont-email.me>, Ted Lee <tmplee@gmail.com> > > wrote: > > > >> The press and gossip rag reports say the recently discovered security > >> flaw with SSL is present in both IOS and OS X. The patch for IOS showed > >> up last night. The reports say the OS X one will be out soon. Has > >> anyone run across a technically competent (as opposed to sensationalized > >> fear-mongering amateur drivel) discussion of the flaw *and* a conclusive > >> statement that it is indeed present in OS X? > > > > it is in os x, and it's nothing more than an extra goto. > > > > <https://www.imperialviolet.org/2014/02/22/applebug.html> > > > ROFL. > > goto has always been a source of low software quality - and it rears its > head again here - although it looks more like sloppy editing than > anything else - like another line of condition code had been deleted or > moved. Like the great Edsger Dijkstra said in 1968: Goto statement considered harmful https://www.cs.utexas.edu/users/EWD/ewd02xx/EWD215.PDF --maarten
[toc] | [prev] | [next] | [standalone]
| From | Alan Browne <alan.browne@FreelunchVideotron.ca> |
|---|---|
| Date | 2014-02-24 18:39 -0500 |
| Message-ID | <dMudndQn8-LbRZbOnZ2dnUVZ_rWdnZ2d@giganews.com> |
| In reply to | #56960 |
On 2014.02.24, 04:43 , Maarten Carels wrote:
> Alan Browne <alan.browne@FreelunchVideotron.ca> wrote:
>
>> On 2014.02.22, 14:15 , nospam wrote:
>>> In article <lears8$l8d$1@dont-email.me>, Ted Lee <tmplee@gmail.com>
>>> wrote:
>>>
>>>> The press and gossip rag reports say the recently discovered security
>>>> flaw with SSL is present in both IOS and OS X. The patch for IOS showed
>>>> up last night. The reports say the OS X one will be out soon. Has
>>>> anyone run across a technically competent (as opposed to sensationalized
>>>> fear-mongering amateur drivel) discussion of the flaw *and* a conclusive
>>>> statement that it is indeed present in OS X?
>>>
>>> it is in os x, and it's nothing more than an extra goto.
>>>
>>> <https://www.imperialviolet.org/2014/02/22/applebug.html>
>>
>>
>> ROFL.
>>
>> goto has always been a source of low software quality - and it rears its
>> head again here - although it looks more like sloppy editing than
>> anything else - like another line of condition code had been deleted or
>> moved.
> Like the great Edsger Dijkstra said in 1968:
> Goto statement considered harmful
> https://www.cs.utexas.edu/users/EWD/ewd02xx/EWD215.PDF
Thanks!!
--
... it may be that "in the cloud" really isn't the best term
for the services these companies offer. What they really
want is to have us "on the leash."
-David Pogue, Scientific American, 2014.02
[toc] | [prev] | [next] | [standalone]
| From | Alan Browne <alan.browne@FreelunchVideotron.ca> |
|---|---|
| Date | 2014-02-24 19:16 -0500 |
| Message-ID | <fYKdnfxGxvxCfZbOnZ2dnUVZ_gqdnZ2d@giganews.com> |
| In reply to | #56960 |
On 2014.02.24, 04:43 , Maarten Carels wrote:
> Alan Browne <alan.browne@FreelunchVideotron.ca> wrote:
>
>> On 2014.02.22, 14:15 , nospam wrote:
>>> In article <lears8$l8d$1@dont-email.me>, Ted Lee <tmplee@gmail.com>
>>> wrote:
>>>
>>>> The press and gossip rag reports say the recently discovered security
>>>> flaw with SSL is present in both IOS and OS X. The patch for IOS showed
>>>> up last night. The reports say the OS X one will be out soon. Has
>>>> anyone run across a technically competent (as opposed to sensationalized
>>>> fear-mongering amateur drivel) discussion of the flaw *and* a conclusive
>>>> statement that it is indeed present in OS X?
>>>
>>> it is in os x, and it's nothing more than an extra goto.
>>>
>>> <https://www.imperialviolet.org/2014/02/22/applebug.html>
>>
>>
>> ROFL.
>>
>> goto has always been a source of low software quality - and it rears its
>> head again here - although it looks more like sloppy editing than
>> anything else - like another line of condition code had been deleted or
>> moved.
> Like the great Edsger Dijkstra said in 1968:
> Goto statement considered harmful
> https://www.cs.utexas.edu/users/EWD/ewd02xx/EWD215.PDF
The last paragraph is very good!
--
Those who have reduced our privacy, whether they are state
or commercial actors, prefer that we do not reduce theirs.
- Jaron Lanier, Scientific American, 2013.11.
[toc] | [prev] | [next] | [standalone]
| From | Alan Browne <alan.browne@FreelunchVideotron.ca> |
|---|---|
| Date | 2014-02-22 14:18 -0500 |
| Message-ID | <QYOdnZ14PrOOZZXOnZ2dnUVZ_t-dnZ2d@giganews.com> |
| In reply to | #56833 |
On 2014.02.22, 13:56 , Ted Lee wrote:
> The press and gossip rag reports say the recently discovered security
> flaw with SSL is present in both IOS and OS X. The patch for IOS showed
> up last night. The reports say the OS X one will be out soon. Has
> anyone run across a technically competent (as opposed to sensationalized
> fear-mongering amateur drivel) discussion of the flaw *and* a conclusive
> statement that it is indeed present in OS X? Given Apple's policy of
> not discussing or acknowledging security flaws until a patch is
> available, I have to wonder if the flaw is in fact present in OS X --
> for, if it were, wouldn't they wait to release anything (including a
> fix) about it until the patch was available for both?
http://9to5mac.com/ has a writeup on it (quoting Crowdstrike). May not
be deep enough for you.
The key thing is the exploit is on the near side of your router firewall
so unless you think junior is attacking from the basement I don't think
there's much to worry about. (I'll assume you're using WPA2 with a
non-trivial shared secret, or better).
QUOTE
To pull off the attack an adversary has to be able to Man-in-The-Middle
(MitM) network connections, which can be done if they are present on the
same wired or wireless network as the victim.
ENDQUOTE
--
Those who have reduced our privacy, whether they are state
or commercial actors, prefer that we do not reduce theirs.
- Jaron Lanier, Scientific American, 2013.11.
[toc] | [prev] | [next] | [standalone]
| From | Tim McNamara <timmcn@bitstream.net> |
|---|---|
| Date | 2014-02-22 13:43 -0600 |
| Message-ID | <slrnlghvee.1tvd.timmcn@sugaree.local> |
| In reply to | #56835 |
On Sat, 22 Feb 2014 14:18:43 -0500, Alan Browne <alan.browne@FreelunchVideotron.ca> wrote: > On 2014.02.22, 13:56 , Ted Lee wrote: >> The press and gossip rag reports say the recently discovered security >> flaw with SSL is present in both IOS and OS X. The patch for IOS >> showed up last night. The reports say the OS X one will be out soon. >> Has anyone run across a technically competent (as opposed to >> sensationalized fear-mongering amateur drivel) discussion of the flaw >> *and* a conclusive statement that it is indeed present in OS X? >> Given Apple's policy of not discussing or acknowledging security >> flaws until a patch is available, I have to wonder if the flaw is in >> fact present in OS X -- for, if it were, wouldn't they wait to >> release anything (including a fix) about it until the patch was >> available for both? > > http://9to5mac.com/ has a writeup on it (quoting Crowdstrike). May > not be deep enough for you. > > The key thing is the exploit is on the near side of your router > firewall so unless you think junior is attacking from the basement I > don't think there's much to worry about. (I'll assume you're using > WPA2 with a non-trivial shared secret, or better). > > QUOTE To pull off the attack an adversary has to be able to > Man-in-The-Middle (MitM) network connections, which can be done if > they are present on the same wired or wireless network as the victim. > ENDQUOTE The risk may be if the user is in a public place like a coffee shop and is spoofed into connecting to a rogue wireless network. Like that's common. There was some really sensationalized stuff on the local TV stations a couple of months ago where someone built a small mobile hotspot that he was able to demonstrate the ability to get private information from computer users. In that case he was usually the man in the middle exploiting web sites with improper security (web sites that are nominally secure but would allow passwords and user names to be sent in the clear), but something could be done that way going in the other direction. Not terribly likely, however.
[toc] | [prev] | [next] | [standalone]
| From | Alan Browne <alan.browne@FreelunchVideotron.ca> |
|---|---|
| Date | 2014-02-22 14:52 -0500 |
| Message-ID | <ALednTfSuYNwYpXOnZ2dnUVZ_gidnZ2d@giganews.com> |
| In reply to | #56836 |
On 2014.02.22, 14:43 , Tim McNamara wrote:
> On Sat, 22 Feb 2014 14:18:43 -0500, Alan Browne
> <alan.browne@FreelunchVideotron.ca> wrote:
>> On 2014.02.22, 13:56 , Ted Lee wrote:
>>> The press and gossip rag reports say the recently discovered security
>>> flaw with SSL is present in both IOS and OS X. The patch for IOS
>>> showed up last night. The reports say the OS X one will be out soon.
>>> Has anyone run across a technically competent (as opposed to
>>> sensationalized fear-mongering amateur drivel) discussion of the flaw
>>> *and* a conclusive statement that it is indeed present in OS X?
>>> Given Apple's policy of not discussing or acknowledging security
>>> flaws until a patch is available, I have to wonder if the flaw is in
>>> fact present in OS X -- for, if it were, wouldn't they wait to
>>> release anything (including a fix) about it until the patch was
>>> available for both?
>>
>> http://9to5mac.com/ has a writeup on it (quoting Crowdstrike). May
>> not be deep enough for you.
>>
>> The key thing is the exploit is on the near side of your router
>> firewall so unless you think junior is attacking from the basement I
>> don't think there's much to worry about. (I'll assume you're using
>> WPA2 with a non-trivial shared secret, or better).
>>
>> QUOTE To pull off the attack an adversary has to be able to
>> Man-in-The-Middle (MitM) network connections, which can be done if
>> they are present on the same wired or wireless network as the victim.
>> ENDQUOTE
>
> The risk may be if the user is in a public place like a coffee shop and
> is spoofed into connecting to a rogue wireless network. Like that's
> common. There was some really sensationalized stuff on the local TV
> stations a couple of months ago where someone built a small mobile
> hotspot that he was able to demonstrate the ability to get private
Private? [1]
> information from computer users. In that case he was usually the man in
> the middle exploiting web sites with improper security (web sites that
> are nominally secure but would allow passwords and user names to be sent
> in the clear), but something could be done that way going in the other
> direction. Not terribly likely, however.
Agreed. Most esp. the last 4 words.
[1] Even on a public network, others will only see your public folder.
Sure, you might have data private to your family there and expect that
only they will see it. Your fault for having it there on a portable
computer.
--
Those who have reduced our privacy, whether they are state
or commercial actors, prefer that we do not reduce theirs.
- Jaron Lanier, Scientific American, 2013.11.
Privacy has become an essential personal chore that most
people are not trained to perform.
- Jaron Lanier, Scientific American, 2013.11.
... it may be that "in the cloud" really isn't the best term
for the services these companies offer. What they really
want is to have us "on the leash."
-David Pogue, Scientific American, 2014.02
[toc] | [prev] | [next] | [standalone]
| From | Richard Kettlewell <rjk@greenend.org.uk> |
|---|---|
| Date | 2014-02-22 20:05 +0000 |
| Message-ID | <wwvvbw63oc8.fsf@l1AntVDjLrnP7Td3DQJ8ynzIq3lJMueXf87AxnpFoA.invalid> |
| In reply to | #56835 |
Alan Browne <alan.browne@FreelunchVideotron.ca> writes: > On 2014.02.22, 13:56 , Ted Lee wrote: >> The press and gossip rag reports say the recently discovered security >> flaw with SSL is present in both IOS and OS X. The patch for IOS showed >> up last night. The reports say the OS X one will be out soon. Has >> anyone run across a technically competent (as opposed to sensationalized >> fear-mongering amateur drivel) discussion of the flaw *and* a conclusive >> statement that it is indeed present in OS X? Given Apple's policy of >> not discussing or acknowledging security flaws until a patch is >> available, I have to wonder if the flaw is in fact present in OS X -- >> for, if it were, wouldn't they wait to release anything (including a >> fix) about it until the patch was available for both? > > http://9to5mac.com/ has a writeup on it (quoting Crowdstrike). May > not be deep enough for you. > > The key thing is the exploit is on the near side of your router > firewall so unless you think junior is attacking from the basement I > don't think there's much to worry about. (I'll assume you're using > WPA2 with a non-trivial shared secret, or better). > > QUOTE > To pull off the attack an adversary has to be able to > Man-in-The-Middle (MitM) network connections, which can be done if > they are present on the same wired or wireless network as the victim. > ENDQUOTE Note that the quoted text doesn’t include the word ‘only’; it is describing only one possible mechanism. To exploit the bug the attacker needs to be able to redirect your communication to and from the real SSL/TLS server to their substitute. There are a number of ways to achieve this, including access to the target network itself, access to intermediate routers, access to a border router, ability to influence DNS responses, etc. ‘Access’ in each case need not be legitimate, of course. -- http://www.greenend.org.uk/rjk/
[toc] | [prev] | [next] | [standalone]
| From | Alan Browne <alan.browne@FreelunchVideotron.ca> |
|---|---|
| Date | 2014-02-22 15:16 -0500 |
| Message-ID | <EsKdne4pJL0AmJTOnZ2dnUVZ_sudnZ2d@giganews.com> |
| In reply to | #56840 |
On 2014.02.22, 15:05 , Richard Kettlewell wrote:
> Alan Browne <alan.browne@FreelunchVideotron.ca> writes:
>> On 2014.02.22, 13:56 , Ted Lee wrote:
>
>>> The press and gossip rag reports say the recently discovered security
>>> flaw with SSL is present in both IOS and OS X. The patch for IOS showed
>>> up last night. The reports say the OS X one will be out soon. Has
>>> anyone run across a technically competent (as opposed to sensationalized
>>> fear-mongering amateur drivel) discussion of the flaw *and* a conclusive
>>> statement that it is indeed present in OS X? Given Apple's policy of
>>> not discussing or acknowledging security flaws until a patch is
>>> available, I have to wonder if the flaw is in fact present in OS X --
>>> for, if it were, wouldn't they wait to release anything (including a
>>> fix) about it until the patch was available for both?
>>
>> http://9to5mac.com/ has a writeup on it (quoting Crowdstrike). May
>> not be deep enough for you.
>>
>> The key thing is the exploit is on the near side of your router
>> firewall so unless you think junior is attacking from the basement I
>> don't think there's much to worry about. (I'll assume you're using
>> WPA2 with a non-trivial shared secret, or better).
>>
>> QUOTE
>> To pull off the attack an adversary has to be able to
>> Man-in-The-Middle (MitM) network connections, which can be done if
>> they are present on the same wired or wireless network as the victim.
>> ENDQUOTE
>
> Note that the quoted text doesn’t include the word ‘only’; it is
> describing only one possible mechanism.
The word "only" is not required to keep that sentence restrained to the
case described. And logically, to be MitM, one has to be "inside" the
router/WiFi firewall.
In that light, a more public attack is well described by Tim McNamara.
--
Privacy has become an essential personal chore that most
people are not trained to perform.
- Jaron Lanier, Scientific American, 2013.11.
[toc] | [prev] | [next] | [standalone]
| From | Richard Kettlewell <rjk@greenend.org.uk> |
|---|---|
| Date | 2014-02-22 21:10 +0000 |
| Message-ID | <wwvmwhi3lcb.fsf@l1AntVDjLrnP7Td3DQJ8ynzIq3lJMueXf87AxnpFoA.invalid> |
| In reply to | #56841 |
Alan Browne <alan.browne@FreelunchVideotron.ca> writes: > The word "only" is not required to keep that sentence restrained to > the case described. And logically, to be MitM, one has to be "inside" > the router/WiFi firewall. MITM refers to an attacker capable of reading, deleting, modifying and synthesizing messages between legitimate actors. See, for instance, s3.1 of Applied Cryptography for more detail. It is not limited to any particular network configuration. -- http://www.greenend.org.uk/rjk/
[toc] | [prev] | [next] | [standalone]
| From | Alan Browne <alan.browne@FreelunchVideotron.ca> |
|---|---|
| Date | 2014-02-22 16:25 -0500 |
| Message-ID | <D-2dnXZP6MFNiJTOnZ2dnUVZ_g6dnZ2d@giganews.com> |
| In reply to | #56844 |
On 2014.02.22, 16:10 , Richard Kettlewell wrote:
> Alan Browne <alan.browne@FreelunchVideotron.ca> writes:
>> The word "only" is not required to keep that sentence restrained to
>> the case described. And logically, to be MitM, one has to be "inside"
>> the router/WiFi firewall.
>
> MITM refers to an attacker capable of reading, deleting, modifying and
> synthesizing messages between legitimate actors. See, for instance,
> s3.1 of Applied Cryptography for more detail. It is not limited to any
> particular network configuration.
Fair enough. OTOH It's pretty clear in this case that the MitM has to
within your network.
I'll be delighted to be proven wrong, however, so please dig that up.
--
Those who have reduced our privacy, whether they are state
or commercial actors, prefer that we do not reduce theirs.
- Jaron Lanier, Scientific American, 2013.11.
[toc] | [prev] | [next] | [standalone]
Page 8 of 10 — ← Prev page 1 … 6 7 [8] 9 10 Next page →
Back to top | Article view | comp.sys.mac.system
csiph-web