Re: [HASMAT] HSTS Threat prevalence

On 08/06/2010 02:09 PM, Devdatta Akhawe wrote:
> #1 would be good - for a reasonably representative sample (i.e. no
> stories ' I once sat in a cafe and ... ').

How about "I've sat in cafes on multiple occasions with professional 
pen-testers who told me that they employ these techniques quite 
effectively on a regular basis"?

- Marsh

> On 6 August 2010 11:52, Steingruebl, Andy<asteingruebl@paypal-inc.com>  wrote:
>>> -----Original Message-----
>>> From: hasmat-bounces@ietf.org [mailto:hasmat-bounces@ietf.org] On
>>> Behalf Of Devdatta Akhawe
>>> Sent: Friday, August 06, 2010 11:36 AM
>>> To: IETF HASMAT list
>>> Subject: [HASMAT] HSTS Threat prevalence
>>>
>>> Hi all
>>>
>>> The HSTS specification talks about possible attacks that could be prevented
>>> by the use of HSTS. Do we have any data that suggests these attacks are
>>> actually a concern / being used by attackers anywhere ? I couldn't find any
>>> citation to this effect in the specification.
>>
>> We are actively doing research in this area, but we don't know of any published work at this point.
>>
>> For the wider audience - do you want to know:
>> 1. Whether this is occurring
>> 2. Its overall frequency/distribution
>> 3. Both
>>
>> Which of these would be most compelling?  On a percentage basis the number of connections being observed by passive network attackers is probably very small.  That doesn't by itself mean to should get rid of TLS.
>>
>> Me - I initially want the answer to #1, and then to #2.
>>
>> - Andy
>>
> _______________________________________________
> HASMAT mailing list
> HASMAT@ietf.org
> https://www.ietf.org/mailman/listinfo/hasmat