I have always thought that the key achievement of SSL was marketing. Specifically, while data can be sniffed off the wire on http connections, this was not a very practical attack until wireless started becoming popular. Compromising clients, servers or phishing were easier and more lucrative. However, people had generalized feelings of insecurity on conducting business over the Internet ("But what if hackers get my credit card with their magic super powers!?"), and SSL was a great solution to that: it is white magic which totally neutralizes the black magic. Take that, hackers -- the Internet is now open for business. And for phishing and insecure passwords and compromised servers but, hey, none of those things scare people away from typing in their credit card numbers.
So to the extent that the white magic doesn't actually work, well, it doesn't really need to work. It just needs to be, to quote the most common description, As Good As What Your Bank Uses.
Sniffing data off the Internet backbone was so practical that there are well-known cases of it actually happening to backbone providers. In one famous case, someone managed to hook solsniff.c up to Sprintnet's core.
I no longer worry about the backbone sniffers - that's like drinking from a firehouse the size of 3 Gorges Dam. You can't surreptitiously consume that much I/O.
I'm much more concerned about small targeted stuff in data centers and colo cages, sniffing just a few backend servers, behind the SSL terminator. Or, you know, just 'select * from creditcardinfo';...
One thing I like about my bank: I can send them an entirely unencrypted email and ask them to move money from my account to some other account, and they will do it.
It was a pleasant surprise that I could do this; I fully expected it to be somewhere between "Not ever gonna happen" and "You can do this at full moon, but only if you stand on one leg while singing the Canadian national anthem blindfolded and entering a secret string of letters and digits into an Advanced Security System with over 9000 bits of encryption".
Comments
I have always thought that the key achievement of SSL was marketing. Specifically, while data can be sniffed off the wire on http connections, this was not a very practical attack until wireless started becoming popular. Compromising clients, servers or phishing were easier and more lucrative. However, people had generalized feelings of insecurity on conducting business over the Internet ("But what if hackers get my credit card with their magic super powers!?"), and SSL was a great solution to that: it is white magic which totally neutralizes the black magic. Take that, hackers -- the Internet is now open for business. And for phishing and insecure passwords and compromised servers but, hey, none of those things scare people away from typing in their credit card numbers.
So to the extent that the white magic doesn't actually work, well, it doesn't really need to work. It just needs to be, to quote the most common description, As Good As What Your Bank Uses.
Sniffing data off the Internet backbone was so practical that there are well-known cases of it actually happening to backbone providers. In one famous case, someone managed to hook solsniff.c up to Sprintnet's core.
I no longer worry about the backbone sniffers - that's like drinking from a firehouse the size of 3 Gorges Dam. You can't surreptitiously consume that much I/O.
I'm much more concerned about small targeted stuff in data centers and colo cages, sniffing just a few backend servers, behind the SSL terminator. Or, you know, just 'select * from creditcardinfo';...
One thing I like about my bank: I can send them an entirely unencrypted email and ask them to move money from my account to some other account, and they will do it.
It was a pleasant surprise that I could do this; I fully expected it to be somewhere between "Not ever gonna happen" and "You can do this at full moon, but only if you stand on one leg while singing the Canadian national anthem blindfolded and entering a secret string of letters and digits into an Advanced Security System with over 9000 bits of encryption".