Re: [saag] Channel binding is great but not a silver bullet

[Alan DeKok <[e-mail]>]

Nicolas Williams wrote:
>    Imagine a coffee house

  ... doing anything but selling coffee.

  Nope, that's not going to work.  I work with/for global WiFi
operators, so I have some experience here.

  Take Starbucks, for example.  They have WiFi.  What do the employees
know about it?  Pretty much nothing.  What do the people who installed
it know about it?  Pretty much nothing.  What does the network operator
*running* the network know about it?  Pretty much nothing.

  You can't begin to believe how bad many of these networks are.

> that posts a certificate fingerprint on a
>    flyer by the cashier, then you can use the coffee house's
>    infrastructure (an access point and a small service running on it) to
>    enrol in any service federated with that coffee house.

  This presumes that social engineering attacks, and/or re-printing
flyers is hard.  It's not.

  Alan DeKok.