Re: https (was: Re: Exploit for DNS Cache Poisoning - RELEASED)

2008-07-25 Thread Jim Popovitch
On Fri, Jul 25, 2008 at 5:52 PM, Matthew Petach <[EMAIL PROTECTED]> wrote: > I'm sure when Gmail gets close to the same number of users > as Yahoo, they will discover how challenging and painful it is > to support that many simultaneous short-lived SSL connections. True, however GMail has the adva

Re: https (was: Re: Exploit for DNS Cache Poisoning - RELEASED)

2008-07-25 Thread Matthew Petach
On 7/24/08, Hank Nussbacher <[EMAIL PROTECTED]> wrote: > On Thu, 24 Jul 2008, Jeffrey Ollie wrote: > > > Interestingly enough, Google just added a feature to GMail to force > > secure connections: > > > http://googlesystem.blogspot.com/2008/07/force-gmail-to-use-secure-connection.html > > > > Jeff

Re: https (was: Re: Exploit for DNS Cache Poisoning - RELEASED)

2008-07-24 Thread Jim Popovitch
On Thu, Jul 24, 2008 at 11:24 PM, Hank Nussbacher <[EMAIL PROTECTED]> wrote: > I wish Yahoo and Hotmail even had the ability of *reading* email via https: > http://www.interall.co.il/hotmail-yahoo-https.html Hah! It was only a year ago that Yahoo even added SSL capabilities for login. Six months

Re: https (was: Re: Exploit for DNS Cache Poisoning - RELEASED)

2008-07-24 Thread Hank Nussbacher
On Thu, 24 Jul 2008, Jeffrey Ollie wrote: Interestingly enough, Google just added a feature to GMail to force secure connections: http://googlesystem.blogspot.com/2008/07/force-gmail-to-use-secure-connection.html Jeff I wish Yahoo and Hotmail even had the ability of *reading* email via http

Re: https (was: Re: Exploit for DNS Cache Poisoning - RELEASED)

2008-07-24 Thread Jeffrey Ollie
On Thu, Jul 24, 2008 at 3:05 AM, Steven M. Bellovin <[EMAIL PROTECTED]> wrote: > > The round trip issue affects latency, which in turn affects perceived > responsiveness. This is quite definitely the reason why gmail doesn't > always use https (though it, unlike some other web sites, doesn't > ref

Re: https (was: Re: Exploit for DNS Cache Poisoning - RELEASED)

2008-07-24 Thread Chris Adams
Once upon a time, Robert Kisteleki <[EMAIL PROTECTED]> said: > I understand this is a huge can of worms, but maybe it's time to change the > default behavior of browsers from http to https...? This is a _DNS_ vulnerability. The Internet is more than HTTP(S). Think about email (how many MTAs do

Re: https (was: Re: Exploit for DNS Cache Poisoning - RELEASED)

2008-07-24 Thread William Pitcock
On Thu, 2008-07-24 at 09:51 +0200, Robert Kisteleki wrote: > Patrick W. Gilmore wrote: > > Anyone have a foolproof way to get grandma to always put "https://"; in > > front of "www"? > > I understand this is a huge can of worms, but maybe it's time to change the > default behavior of browsers fr

Re: https (was: Re: Exploit for DNS Cache Poisoning - RELEASED)

2008-07-24 Thread Jasper Bryant-Greene
On Thu, 2008-07-24 at 09:51 +0200, Robert Kisteleki wrote: > Patrick W. Gilmore wrote: > > Anyone have a foolproof way to get grandma to always put "https://"; in > > front of "www"? > > I understand this is a huge can of worms, but maybe it's time to change the > default behavior of browsers fr

Re: https (was: Re: Exploit for DNS Cache Poisoning - RELEASED)

2008-07-24 Thread Steven M. Bellovin
On Thu, 24 Jul 2008 09:51:40 +0200 Robert Kisteleki <[EMAIL PROTECTED]> wrote: > Patrick W. Gilmore wrote: > > Anyone have a foolproof way to get grandma to always put "https://"; > > in front of "www"? > > I understand this is a huge can of worms, but maybe it's time to > change the default beha

https (was: Re: Exploit for DNS Cache Poisoning - RELEASED)

2008-07-24 Thread Robert Kisteleki
Patrick W. Gilmore wrote: Anyone have a foolproof way to get grandma to always put "https://"; in front of "www"? I understand this is a huge can of worms, but maybe it's time to change the default behavior of browsers from http to https...? I'm sure it's doable in FF with a simple plugin, o