Security Basics mailing list archives
RE: RPC over HTTP security
From: Shawn Wall <sjwall () shaw ca>
Date: Fri, 28 Jan 2005 14:09:51 -0700
Comments inline -----Original Message----- From: James McGee [mailto:james () infosec co im] Sent: Friday, January 28, 2005 12:41 PM To: Shawn Wall; Eric McCarty; Kevin Doheny; sf_mail_sbm () yahoo com; security-basics () securityfocus com Subject: RE: RPC over HTTP security Yes, probably trillions of dollars are transacted via SSL. But, SSL, does not offer the server much security, if anything it reduces it for the server end.
I agree that SSL does squat for sever security, never said it did.
SSL encrypts traffic between client/server or server/server. The trouble is, you can't then see what's in the traffic, with your average IDS, unless you offload the encryption to an SSL terminator.
This requires a more advanced configuration, as you eluded to.
SSL was setup to encrypt sensitive data from the client, and to offer re-assurance to the end-user (read client).
Stating the obvious.
I had a project manager compare SSL to PKI, which is not a comparison. SSL costs <$100 PKI probably >$10000. Don't that tell you something.
This tells me that PKI is more expensive to deploy that SSL. Security is
often a trade off against cost. For email, PKI may be too expensive for most SMB. In a banking type application, the data that is protected is primarily the user data, so it increases user confidence. But it don't do much for the bank's servers......
Again, we all know the sever is not protected.
Cheers James -----Original Message----- From: Shawn Wall [mailto:sjwall () shaw ca] Sent: 28 January 2005 17:54 To: 'Eric McCarty'; 'Kevin Doheny'; sf_mail_sbm () yahoo com; security-basics () securityfocus com Subject: RE: RPC over HTTP security I'd have to agree with Eric on this one. SSL is a proven encryption method. Billions of dollars are transefer via SSL encypted sites every year. If was as trivial to 'hack' as you suggest, Kevin, I don't think it would be in use. Perhaps you could do as Eric suggested and provide some factual proof. shawn -----Original Message----- From: Eric McCarty [mailto:eric () piteduncan com] Sent: Friday, January 28, 2005 10:35 AM To: Kevin Doheny; Shawn Wall; sf_mail_sbm () yahoo com; security-basics () securityfocus com Subject: RE: RPC over HTTP security Your joking right. "SSL in and of itself provides very little security" That's why most of the internet uses it right?. Your gonna have to back up statements like yours with some serious factual backing otherwise your comments will be discarded as B.S coming form someone who doesn't know what they are talking about. E. -----Original Message----- From: Kevin Doheny [mailto:kdoheny () CNP net] Sent: Friday, January 28, 2005 5:06 AM To: Shawn Wall; sf_mail_sbm () yahoo com; security-basics () securityfocus com Subject: RE: RPC over HTTP security SSL in and of itself provides very little security... Way to easy to hack. Look into a Neoteris (now Juniper) SSL VPN/Proxy. This way evil hack3r can not ride the SSL stream into your network and past any IDS or IPS systems. Kevin -----Original Message----- From: Shawn Wall [mailto:sjwall () shaw ca] Sent: Wednesday, January 26, 2005 11:04 PM To: sf_mail_sbm () yahoo com; security-basics () securityfocus com Subject: RE: RPC over HTTP security Are you using Exchange? Why not use OWA and secure it with SSL? shawn -----Original Message----- From: sf_mail_sbm () yahoo com [mailto:sf_mail_sbm () yahoo com] Sent: Wednesday, January 26, 2005 6:03 AM To: security-basics () securityfocus com Subject: RPC over HTTP security Hi List, We are thinking about deploying RPC over HTTP to access email from the Internet Wanted to get some information on the technology and the security implications of same Not much info from Microsoft's site any help would be greatly apreciated Thanks, Ronish
Current thread:
- RE: RPC over HTTP security, (continued)
- RE: RPC over HTTP security Shawn Wall (Jan 31)
- RE: RPC over HTTP security Killian Doyle (Jan 28)
- RE: RPC over HTTP security Depp, Dennis M. (Jan 28)
- Re: RPC over HTTP security sf_mail_sbm (Jan 28)
- RE: RPC over HTTP security Eric McCarty (Jan 31)
- RE: RPC over HTTP security Beauford, Jason (Jan 31)
- RE: RPC over HTTP security Depp, Dennis M. (Jan 31)
- RE: RPC over HTTP security LordInfidel (Jan 31)
- RE: RPC over HTTP security Depp, Dennis M. (Jan 31)
- RE: RPC over HTTP security James McGee (Jan 31)
- RE: RPC over HTTP security Shawn Wall (Jan 31)
- RE: RPC over HTTP security LordInfidel (Jan 31)
- RE: RPC over HTTP security Paris E. Stone (Jan 31)
- RE: RPC over HTTP security Depp, Dennis M. (Jan 31)