Re: HTTP is just fine -- v. HTTP is insecure --> need a better metaphor

> > Not true at all there are many forms, SSL as a form of amplification can
> > wreak major havoc. A 100x amplification was demonstrated by tying
> > together attacks involving DNSSEC and TLS.  
> 
> The SSL/TLS attack is that you can make the server use more CPU time 
> than the client.
> 
> The DNSSEC thing is probably just about a DNS reflection attack, but 
> that a DNSSEC enabled domain usually returns more data.  There are also 
> DNSSEC implementations that sign on the fly so you can get those to use 
> more CPU too.
> 
> I'm not sure what you mean with 100x when combining DNSSEC and TLS, and 
> what is exactly 100 times more.

Firstly my main objection is simply around the notion of SSL
*everywhere* being so heavily advocated and any opposition being
mocked. Whilst some features that I am not aware of yet like GPU usage
over http *insecure* warnings may be a concern. I would never send a
password field over http, as why have the password in the first place.

I have to admit that I forget the details of the demonstration and
didn't have time to look into it very deeply, so whilst secure
re-negotiation could possibly be used to amplify connection saturation
I am guessing it may have been 100x server resource consumption.
Unfortunately a quick search doesn't turn up the info that could well
have been connection saturation and I have so much to do before xmas,
sorry.

I have however set my server up to drop TLS in an arguably feeble but
perfectly valid effort to maximise our chances of delivering any
content under an attack that would likely also aid any DDOS protection
service too. SSH will likely be a higher priority for protection than
SSL for our business in any case and custom measures may be used there.

When we can afford a service like cloudfare and find we can use it
without adding unwanted javascript and analytics to our sites then I
guess but am not completely sure that that will just make it less likely
that we would need to block TLS or port 443 but not remove the measure
as a last resort defence entirely?

-- 

KISSIS - Keep It Simple So It's Securable