Hacker News new | past | comments | ask | show | jobs | submit login

People aren't anywhere close to sophisticated enough to make meaningful use of this more complicated functionality.

What they're going to do if given this is call your hypothetical "SECLEVEL=M" feature secure and then be outraged when it isn't.

If nobody is attacking you, no security will work fine. If you are being attacked, obsolete security likely won't help anyway.




If you think of the ideal attacker as having a range of abilities and knowledge between "I found this tool on BitTorrent and am now going to try cracking your network from the outside with it" to "I spread my port scans out to multiple exit nodes over several days so you don't even notice me doing it" then having any security is better than nothing. All you have to do is make the sliver on the venn diagram of people who are trying to attack your system versus people who know how to attack your system as small as possible. It's not rocket science, and there are a lot of factors to balance here beyond the security level of a particular cipher.


I am forced to make my connection less secure than someone who hasn't updated. What's the logic behind that?


I'm not sure if you've ever plugged into the internet, but there are constant probes occurring. They may not be an attack but simple information gathering that is used later (say someone finds a weakness in your configuration) and you and everything like you is attacked at once.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: