Hacker News Reader

VPNs however add considerable latency as well as cost and complexity. Its not like there is no down side to using VPNs. If your using SSH and a web browser which isn't susceptible to the current SSL exploits, I don't see why I would want to use a VPN over Wi-Fi.

View on HN

DNS lookups are not currently signed nor authenticated, neither of which go through ssh or the browser's SSL stack, which is a major attack vector for MITM.

SSL was designed not to care that DNS is insecure.

Heading off one likely response to this comment: it is silly to look at a bug in probably the best-tested piece of security code on the planet (Microsoft's CryptoAPI/schannel code) and arrive at the conclusion that DNSSEC, a protocol nobody has ever deployed successful at scale, isn't hiding many worse bugs.

The same obviously goes for SSH, which uses key continuity so as not to care that DNS is insecure.

While all that's true, it's not the design of SSL that is at issue, but rather bugs in the SSL stack, such as this null-prefix certificates issue. While I don't know the state of Microsoft's stack for this bug, ubuntu just released a patch for wget yesterday for it (USN-842-1, CVE-2009-3490). No one is really talking about DNSSEC, but if you were using a wifi connection (the original use case in this thread of using a VPN over wifi) and thought you were secure because you were using SSL, MITM via DNS is still a possible attack vector, as hapless points out elsewhere in these comments. Obviously a VPN over wifi wouldn't secure you for accessing paypal.com via SSL (which is a public resource), but other, private resources secured with only SSL but resolved via public DNS are at risk (wifi or not).

Reply on news.ycombinator.com