• 0 Posts
  • 3 Comments
Joined 2 years ago
cake
Cake day: May 14th, 2024

help-circle


  • I think the big takeaway here is that if you’re using Tor, or a VPN, or really the internet in general, you always need to think about MITM attacks. There are a lot of standard protections against exactly this kind of attack.

    …users who ignored warnings that the SSH host key had changed…

    SSH keys are one of those protections. Don’t ignore the warnings. That’s a big red flashing DANGER sign.

    …block ports … used to accept various forms of encrypted email—while continuing to allow ports for receiving unencrypted email. If email services downgraded the connections…

    TLS connections are another of those protections; don’t use apps or services that allow plaintext communication.

    I’d be interested to know which email clients will downgrade connections by default. That is an absolutely insane thing to do. I don’t think my email provider even accepts unencrypted connections anymore.

    This is scary but really, nobody’s supposed to trust Tor exit nodes in the first place. This doesn’t drastically change my comfort level with Tor. But it’s a good reminder that you need to be mindful of how your apps are configured.