RE: RPC over HTTP security

["Sarbjit Singh Gill" <ssgill () gilltechnologies com>]

True, true ... I do my internet banking all based on the bank using SSL (128
bits).

/Gill

 

> -----Original Message-----
> From: Shawn Wall [mailto:sjwall () shaw ca] 
> Sent: Saturday, January 29, 2005 1:54 AM
> To: 'Eric McCarty'; 'Kevin Doheny'; sf_mail_sbm () yahoo com; 
> security-basics () securityfocus com
> Subject: RE: RPC over HTTP security
>
> I'd have to agree with Eric on this one. SSL is a proven 
> encryption method.
> Billions of dollars are transefer via SSL encypted sites 
> every year. If was as trivial to 'hack' as you suggest, 
> Kevin, I don't think it would be in use. Perhaps you could do 
> as Eric suggested and provide some factual proof.
>
> shawn 
>
> -----Original Message-----
> From: Eric McCarty [mailto:eric () piteduncan com]
> Sent: Friday, January 28, 2005 10:35 AM
> To: Kevin Doheny; Shawn Wall; sf_mail_sbm () yahoo com; 
> security-basics () securityfocus com
> Subject: RE: RPC over HTTP security
>
> Your joking right.
>
> "SSL in and of itself provides very little security"
>
> That's why most of the internet uses it right?. 
>
> Your gonna have to back up statements like yours with some 
> serious factual backing otherwise your comments will be 
> discarded as B.S coming form someone who doesn't know what 
> they are talking about.
>
> E. 
>
> -----Original Message-----
> From: Kevin Doheny [mailto:kdoheny () CNP net]
> Sent: Friday, January 28, 2005 5:06 AM
> To: Shawn Wall; sf_mail_sbm () yahoo com; 
> security-basics () securityfocus com
> Subject: RE: RPC over HTTP security
>
> SSL in and of itself provides very little security... Way to 
> easy to hack.
> Look into a Neoteris (now Juniper) SSL VPN/Proxy.  This way 
> evil hack3r can not ride the SSL stream into your network and 
> past any IDS or IPS systems. 
>
> Kevin 
>
> -----Original Message-----
> From: Shawn Wall [mailto:sjwall () shaw ca]
> Sent: Wednesday, January 26, 2005 11:04 PM
> To: sf_mail_sbm () yahoo com; security-basics () securityfocus com
> Subject: RE: RPC over HTTP security
>
> Are you using Exchange? Why not use OWA and secure it with SSL?
>
> shawn 
>
> -----Original Message-----
> From: sf_mail_sbm () yahoo com [mailto:sf_mail_sbm () yahoo com]
> Sent: Wednesday, January 26, 2005 6:03 AM
> To: security-basics () securityfocus com
> Subject: RPC over HTTP security
>
>
>
> Hi List,
> We are thinking about deploying RPC over HTTP to access email 
> from the Internet
>
> Wanted to get some information on the technology and the 
> security implications of same
>
> Not much info from Microsoft's site
>
> any help would be greatly apreciated
>
> Thanks,
> Ronish