[144299] in cryptography@c2.net mail archive
Re: Security through kittens, was Solving password problems
daemon@ATHENA.MIT.EDU (John Levine)
Wed Feb 25 10:49:41 2009
Date: 25 Feb 2009 14:53:39 -0000
From: John Levine <johnl@iecc.com>
To: cryptography@metzdowd.com
In-Reply-To: <49A54F4E.7050509@uiuc.edu>
Cc: vwelch@illinois.edu
>This means a site paying attention to such things could notice a
>change in IP address, or, if several users were attacked this way,
>notice repeated connections from the same IP. (Granted the MITM
>could distribute the queries over a botnet, but it raises the bar
>somewhat.)
>
>I have no idea if sites do such check, just speculation on my part.
You're right, but it's not obvious to me how a site can tell an evil
MITM proxy from a benign shared web cache. The sequence of page
accesses would be pretty similar. I suppose that you could hope that
legitimate HTTPS requests would come direct from the client machine,
so requests for multiple users on the same IP would be suspicious, but
on networks like AOL's, I wouldn't count on it working that way.
R's,
John
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
