Am I missing something, or is the Android/wpa_supplicant "all zero key" KRACK bug mostly FUD? Surely wrong key = traffic can't flow.
-
Show this thread
-
Replying to @marcan42
Watch the video, all there https://m.youtube.com/watch?v=Oh4WURZoR98&time_continue=3 …
1 reply 0 retweets 0 likes -
Replying to @jmarcelino
He's not MITMing the AP in that video, only the association. He routes all the data out the side. Doesn't work for private network resources
2 replies 0 retweets 0 likes -
Replying to @marcan42 @jmarcelino
True, but it lets you MITM public resources. Which is itself a big deal.
1 reply 0 retweets 0 likes -
Replying to @pikhq @jmarcelino
But there are a bazillion other ways of MITMing public resources. Which is why we have HTTPS. Threat is no different from using public WiFi.
2 replies 0 retweets 0 likes -
Replying to @marcan42 @jmarcelino
Sure, but this reduces the threshold from "can convince them to use your AP" or similar to just "am near them".
1 reply 0 retweets 0 likes -
Replying to @pikhq @jmarcelino
If they've *ever* connected to a public/known WiFi you can already impersonate that and deauth them if you're near.
1 reply 0 retweets 0 likes -
Except on localhost in isolated network namespaces, and over UNIX sockets. Kill it with fire everywhere else.
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.