Interlude - Absolutely Brilliant Punking and an Occasion for Nail-Biting

I know, I know -- I promised you some glowing glosses on the Glorious Plan.


But first -- humor -- via this absolutely brilliant piece of network hacking by Peter Stevens at ex-parrot.com ...

My neighbours are stealing my wireless internet access. I could encrypt it or alternately I could have fun.

...

Pete then shows how all "unknown" network traffic -- i.e., from any device he hasn't specifically told his server about -- can be automatically redirected.

His router-server can intercept every HTTP request that passes through it, and his firewall can be configured to do things to the requests/responses:

• either force the Wifi-poacher to vote abou kitten pictures eternally, or ...
• dynamically intercept all inbound images, flip them, and seamlessly insert them back ...

All of which is absolutely hilarious. (And if you don't think so, then you're a Godless Un-American Communist Reprobate. So there.)


But -- in all seriousness -- this also illustrates how important Internet Showers are.

Yeah, the "correct" term is Internet Hygiene -- which makes me think of formaldehyde, powdered latex, and Clorox -- hence the not-quite-so-stupid neologism.

• The more hair-raising attack described here -- the image-flipper -- is a kind of Man-in-the-Middle (MITM) attack. It's most often used to impersonate legit sites -- say, to give you a fake bank website -- to steal your log-in.
  
  So far as I know, this is entirely preventable by using SSL -- or, the 's' in https. That causes the connection to be encrypted from start-to-finish, with (practically) unbreakable encryption and authentication.
  
  Caveat: most of the time, your browser will download resources -- images, scripts, etc. -- via plain-old HTTP, without using SSL. This is because most high-demand sites -- like eBay -- would prefer to avoid the overhead of using SSL for every single image requested.
  
  So, the image-flipper would be able to substitute images just fine, so long as they weren't delivered over SSL.
  Hey, everything's a trade-off.
  
• Note on the above: Of course, it's still entirely possible to put yourself into a vulnerable position when using SSL. The trick comes from the way SSL works -- by exchanging certificates.
  Ordinarily, your browser and the end-server each exchange certificates -- i.e., identifiers with strong cryptographic properties that unique identify the bearers.
  
  Via the use of strong math-fu, the two end-points can use these certificates communicate securely, each confident that what they receive is what the other actually sent.
  
  And most of the time, proxy servers are polite enough to respect this. A well-mannered proxy will handle only unsecured, plain-old HTTP traffic.
  
  Of course, every so often -- especially behind university or corporate firewalls -- the resident proxy server insists on handling everything that passes through it. In that case, a couple of things will happen:
  
• The proxy will intercept your request to the end-server, and its response to you. It'll store both your SSL certificates. In the process, the proxy will create its own SSL certificate.
  
• From then on, the proxy will use its own certificate whenever it relays messages between you and the end-server.
  
  You can tell when this is happening, as your browser will give you a big warning message:

• When this happens -- I'm half-ashamed to say that I usually just acquiesce with it out of lethargy -- "who has time to complain about this", etc., etc.
  
  But it's something to keep in mind.