All serious attackers are man-in-the-middle attackers (usually by tricking victims into diverting their own traffic, not literally by inserting themselves into the network path). Passive-only attackers went extinct along with the backbone-connected Sun servers that were used to launch those attacks.

I don't so much care about the rest of this analysis, but you can't call an unauthenticated TLS session "secure".

▲

stingraycharles 3 hours ago | parent [-]

> usually by tricking victims into diverting their own traffic

What does this mean practically? Getting a VPN profile installed ?

▲

tptacek 3 hours ago | parent | next [-]

No, the simplest (but far from the only) example is DNS injection.

▲

embedding-shape 3 hours ago | parent | prev [-]

Make the web unusable unless you're protected by your "DDOS" protection, offer a free service to solve the problem. Or provide a free service with as little friction to start replacing private/internal networking with, ideally with wide platform support. Or provide some sort of alternative "private" altnet, promising anonymity and access to clearnet via some sort of gateways, specifically for murky stuff.

	▲	alwa 3 hours ago \| parent [-]
		Or, of course, go high-touch: sell hyper-e2e-encrypted, hardware+software mobile devices directly to crime syndicates, explicitly to keep their traffic safe from prying governmental men-in-the-middle… [0] https://en.wikipedia.org/wiki/EncroChat