Hacker News Reader

Comment by y0ghur7_xxx | Hacker News Reader

> Opportunistic Encryption is harmful because people think it's actually useful. [...] You should never assume that 'eavesdropping' is passive.

- Google driving by with it's street view cars and capturing all your wifi traffic for later analysis is passive.

- People sitting in a coffee shop and capturing your wifi traffic is passive.

OE protects against these attack vectors. It does not protect against other attack vectors, but that does not mean it's harmful or useless.

Moreover, with pins it could be a first step to get rid of CAs.

View on HN

>- People sitting in a coffee shop and capturing your wifi traffic is passive.

OE does NOT protect against this. If you can read wifi packets you can write them and MITM. You're basically arguing that at the moment it's more likely that they are using a snooping package that doesn't MITM. Sorta like "use Mac/Linux cause there's no viruses/malware/keyloggers". If there's a shift to OE, then sniffing packages will provide plugins to MITM OE when possible.

So sure, turn on OE, it won't _hurt_ if we don't tell the users via UI that there's anything special going on. It's like a CRC check to prevent minor accidents.

These are both examples of how OE would _not_ help you.

With google street view you're barely even in range long enough to pick up a couple packets, if the person was even using their computer while the car drove by; this is not what OE is designed to protect against. If the car sat outside their house, they'd still get owned, and OE would still not be useful.

Sitting on a cafe's wireless is literally the de-facto example of how to actively sniff or inject traffic on an unsuspecting victim. The only more bluntly useless case for OE is a state-sponsored mitm using coercion-induced signed certificates.

And you can't get rid of CAs.

You just continue to state the same thing: that OE does not protect against an active attacker. We know that. Nobody says that it does. What it does is protect against a passive attacker. And that makes it useful for some use cases.

Reply on news.ycombinator.com