Follow Slashdot blog updates by subscribing to our blog RSS feed


Forgot your password?

Comment: Re:Interesting end run (Score 1) 57

by dopodot (#37486714) Attached to: Surveillance Case May Reveal FBI Cellphone Tracking Techniques

The 3G/UMTS protocols have the handset authenticate the network exactly to protect against fake base station attacks.

For GSM, this is not the case -- handsets do not authenticate the towers they're connecting to. It's trivial to become the loudest tower and get the phone to switch over to you... but there are technical hurdles around connecting back to the wireless carriers and getting calls / SMS to work correctly in both directions.

Comment: Re:Dissabling SSL re-negotiation? (Score 5, Informative) 170

by dopodot (#29995268) Attached to: Man-In-the-Middle Vulnerability For SSL and TLS
It's more than changing the cipher type, it's also negotiating up from anonymous client to verified client. The second situation occurs ALL THE TIME in web services that require different levels of trust for different content within the same site. So it's not a "seldom-used" feature in the least.

Comment: Re:Paypal uses an EV cert. (Score 2, Insightful) 351

by dopodot (#29664589) Attached to: Null-Prefix SSL Certificate For PayPal Released
Do you really think the average user is going to notice a lack of green bar? Internet Explorer is going to accept this certificate as valid for and there will be no hints to the user that it's actually illegitimate. Unless there's some other mechanism in Internet Explorer that will notice it got an EV cert in the past and is no longer getting it, then this cert is entirely usable for a man in the middle.

Comment: Re:I'm nervous about this (Score 2, Informative) 194

by dopodot (#28034931) Attached to: FSF Settles Suit Against Cisco
They're only releasing source code related to the Linksys products, which were in violation. Cisco acquired Linksys a few years ago -- Linksys still operates mostly as their own company. Cisco proper already has people responsible for ensuring source license compliance and they seem to have done a good job. I don't think there's any GPL code in IOS, which is what it sounds like you're worried about. There's lots of BSD-style code though.

Air is water with holes in it.