Re: [hybi] Why not just use ssh?

[Gabriel Montenegro <[e-mail]>]

> > I might have missed that part of the discussion, but, if the server is replying to
> an Upgrade (perhaps over HTTPS) with a 101, and with a random nonce sent by
> the client, how is this vulnerable to a cross-protocol attack?
> 
> Cross-protocol attacks are quite subtle and generally take years to uncover.
> Your statement is roughly equivalent to "protocol XYZ uses encryption, it might
> be secure against man-in-the-middle attacks, right?"

Not sure how you made that jump. Along the lines of the above, your statement then could be claimed to be "roughly equivalent" to:

"protocol XYZ uses TLS-NPN, obviously it will be impervious to as yet unknown and undiscovered attacks"

Neither statement makes much sense, but luckily nobody's said either of the above. We design protocols based on plausible threat models. If we don't know all the attacks, then increased complexity is not necessarily the answer. Often times it has the opposite effect.