Re: Ethernet cable question.

In article <#Tu9K7oHJHA.3668@xxxxxxxxxxxxxxxxxxxx>,
Paul Montgumdrop <Paul@xxxxxxxxxxxxxxx> wrote:

This is stupid, and I know better. I have developed Web HTTPS site
solutions on the server and on the client end. If it was so easily
breakable as you claim, then a whole lot of transmission of sensitive
data would be getting compromised and eavesdropped on. And it would be

With all due respect, you're making a typical mistake. HTTPS
*CAN* be secure. HTTPS is NOT forced to be secure merely by virtue of
appending an S.

For instance, your browser considers any connection "secured"
by some form of SSL to be secure and makes no distinction bewteen 40 bit
encryption and 256 bit. If the website is accidentally or on purpose
configured to accept 40 or 56 bit you may connect insecurely although
you think you are connecting securely. For a discussion of this problem
see

http://www.verisign.com/static/036094.pdf&usg=AFQjCNEZReuU9dor6or5jZusQH52Z-kLCA

Furthermore, the acceptable ciphers are not all secure. The server
may insist - again without notifying the user - that the conversation use
an insecure RC4 (for instance) cipher.

And when a person is finished with the bank transactions in a HTTPS
session, goes to another site, it's not an HTTPS site, and there person
gives up sensitive data over the Internet, then that's falls under the
ignorance of the user and is NOT a HTTPS issue on security.

That's exactly the situtation that a strong local security
policy is meant to protect you from. Someone else tried to use the idea
that because the bank conversation is encrypted you don't need to encrypt
the link. That's not true, exactly because of the situation you point out.

And for you to say that some bank site may not be set-up correctly or
that the Web site developer(s) who have developed, tested, went through
quality assurance testing to ensure the integrity of the site solution
and the staff did not know how secure the solution is ridiculous,

Pfffft. Are you telling me that people never make mistakes? Or
that insiders never deliberately open holes to exploit for their own
purposes? Or that intruders never modify system configurations? These kinds
of things happen all the time. A typical example: administrator specifies
256 bit but the product isn't licensed for that level and so falls back to
56. The admin won't even notice until the next security audit because it's
not an error and everything looks just fine. (well, she might, if she's
good.)


Great Ghu, even classified systems get compromised. Don't you
think it could happen at a bank?


particularly at banks. What? Do you think people who hold those
positions don't know about the attack vectors and how to prevent them?

To err is human. And you can really foul things up if you're
using a computer. You're saying I should trust these unknown people because
they work at a bank. Talk about silly.

.

Relevant Pages

  • Re: http to https redirect for OWA
    ... web browser it automatically goes to the secure ... ISA server. ... beacuse I have a Server running Small Business Server ... >| http request to https for the OWA website? ...
    (microsoft.public.isa)
  • Re: SSL Encryption
    ... This question was asked because we're considering a web service scenario. ... consider it secure. ... >>send credentials to the secure server BEFORE the secure channel is there? ... > You're essentially never going to get the chance, if you ask for an HTTPS ...
    (microsoft.public.inetserver.iis.security)
  • Re: How secure is RWW
    ... Going https your browser sends encrypted info over the web...pretty secure. ... more secure connection between client and server than say previous VPN ...
    (microsoft.public.windows.server.sbs)
  • Re: OWA and POP3 question
    ... As secure as a credit card transaction on banking sites. ... > So if I open port 443 for https and allow users to connect to my exchange ... >>> exchange server and allow them to retreive and send email via POP3, ...
    (microsoft.public.windows.server.sbs)
  • Re: Is this REALLY a secure site?
    ... >> How can anyone really know if an SSL or HTTPS connection is truly ... Even if it is theoretically secure ... major credit card company wound up making the authorization against my ... > site uses a numerical IP address: those are always bogus. ...
    (microsoft.public.windowsxp.general)