this post was submitted on 06 Oct 2024
735 points (90.8% liked)

Technology

60073 readers
2964 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 2 years ago
MODERATORS
 

you are viewing a single comment's thread
view the rest of the comments
[–] asdfasdfasdf@lemmy.world 43 points 2 months ago* (last edited 2 months ago) (3 children)

How is DPI a problem if it's encrypted? That would only work if the attacker had installed their CA cert on your client machine, right?

[–] henfredemars@infosec.pub 48 points 2 months ago (1 children)

I’m doing DPI on my own network and I can still view TLS certificate fingerprints and some metadata that provides a good educated guess as to what a traffic flow contains. It certainly better that it’s encrypted, but there is a little information that leaks in metadata. I think that’s what was meant.

[–] catloaf@lemm.ee 30 points 2 months ago* (last edited 2 months ago) (1 children)

True, but this is generally not useful information to anyone. They can see you're visiting bank.com, but they still can't see your bank details.

It might be useful if they're trying to target you for phishing, but a targeted attack is extremely unlikely.

Also, any wireless equipment from the past 15 years or so supports client isolation.

[–] groet@feddit.org 13 points 2 months ago

Client isolation doesn't help. That is just the access point not routing traffic between connected devices. The problem with WiFi is it is a radio signal. Everybody in range can receive 100% of all communication on that network. Just by being in range the attacker can do passive sniffing. No wiretap needed like with cabled networks.

WiFi is encryoed if it uses a password. So any public WiFi without a password can be sniffed by literally every device in range (no need to connect to the WiFi for sniffing). On public WiFi with a password, the radio signal is encrypted but everybody knows the encryption key. So everybody connected to the WiFi can still sniff the traffic of everybody else.

That encryption is only on the WiFi level, so encrypted radio signals, not on the actually traffic level (like TLS/HTTPS etc).

[–] orange@communick.news 12 points 2 months ago* (last edited 2 months ago)

I think it might be confusion between inspecting plaintext metadata like SNI vs actually inspecting encrypted contents (e.g. HTTPS content, headers, etc.).

[–] Dark_Arc@social.packetloss.gg 9 points 2 months ago

Yeah, deep packet inspection really doesn't work without breaking https security via man in the middling everything.