Yes, probably trillions of dollars are transacted via SSL. But, SSL,
does not offer the server much security, if anything it reduces it for
the server end.
SSL encrypts traffic between client/server or server/server. The
trouble is, you can't then see what's in the traffic, with your average
IDS, unless you offload the encryption to an SSL terminator.
SSL was setup to encrypt sensitive data from the client, and to offer
re-assurance to the end-user (read client).
I had a project manager compare SSL to PKI, which is not a comparison.
SSL costs <$100 PKI probably >$10000. Don't that tell you something.
In a banking type application, the data that is protected is primarily
the user data, so it increases user confidence. But it don't do much
for the bank's servers......
Cheers
James
-----Original Message-----
From: Shawn Wall [mailto:sjwall@shaw.ca]
Sent: 28 January 2005 17:54
To: 'Eric McCarty'; 'Kevin Doheny'; sf_mail_sbm@yahoo.com;
security-basics@securityfocus.com
Subject: RE: RPC over HTTP security
I'd have to agree with Eric on this one. SSL is a proven encryption
method.
Billions of dollars are transefer via SSL encypted sites every year. If
was as trivial to 'hack' as you suggest, Kevin, I don't think it would
be in use. Perhaps you could do as Eric suggested and provide some
factual proof.
shawn
-----Original Message-----
From: Eric McCarty [mailto:eric@piteduncan.com]
Sent: Friday, January 28, 2005 10:35 AM
To: Kevin Doheny; Shawn Wall; sf_mail_sbm@yahoo.com;
security-basics@securityfocus.com
Subject: RE: RPC over HTTP security
Your joking right.
"SSL in and of itself provides very little security"
That's why most of the internet uses it right?.
Your gonna have to back up statements like yours with some serious
factual backing otherwise your comments will be discarded as B.S coming
form someone who doesn't know what they are talking about.
E.
-----Original Message-----
From: Kevin Doheny [mailto:kdoheny@CNP.net]
Sent: Friday, January 28, 2005 5:06 AM
To: Shawn Wall; sf_mail_sbm@yahoo.com; security-basics@securityfocus.com
Subject: RE: RPC over HTTP security
SSL in and of itself provides very little security... Way to easy to
hack.
Look into a Neoteris (now Juniper) SSL VPN/Proxy. This way evil hack3r
can not ride the SSL stream into your network and past any IDS or IPS
systems.
Kevin
-----Original Message-----
From: Shawn Wall [mailto:sjwall@shaw.ca]
Sent: Wednesday, January 26, 2005 11:04 PM
To: sf_mail_sbm@yahoo.com; security-basics@securityfocus.com
Subject: RE: RPC over HTTP security
Are you using Exchange? Why not use OWA and secure it with SSL?
shawn
-----Original Message-----
From: sf_mail_sbm@yahoo.com [mailto:sf_mail_sbm@yahoo.com]
Sent: Wednesday, January 26, 2005 6:03 AM
To: security-basics@securityfocus.com
Subject: RPC over HTTP security
Hi List,
We are thinking about deploying RPC over HTTP to access email from the
Internet
Wanted to get some information on the technology and the security
implications of same
Not much info from Microsoft's site
any help would be greatly apreciated
Thanks,
Ronish
