Re: encryption options for public networks?

On Thu, 2005-01-20 at 11:34 -0800, Matt Westervelt wrote:
> Setting up a socks4 proxy with ssh is:
> 
> ssh user@host -D1080

Now point all your socks aware apps at this server, then point them back
when you done. Also this still has to use the dhcp provided dns servers
to get name resolution. 

I consider myself I fairly technical user, and have used this on
OSX/Windows/*nix but always find it too cumbersome. The closest I came
was using using the OSX network locations, which was pretty easy but
still not as easy as it should be.

Also I believe the big problem with this solution is that if the user
has no easy way to know if their traffic is encrypted. If I start an app
that does not have socks support, and I am a normal user, I might assume
I am safe because my ssh connection is up. If I am using a vpn client
that routes all traffic through the termination point, I know that all
my internet talking packets are being encrypted becuase the little
flashy icon tells me so.

> 
> seems pretty easy to me.

Easy is a pptp server (MS or Linux/poptop), click a desktop icon all
traffic (except arp/local subnet ip) is routed through the tunnel end
point.

Yes pptp has its flaws/vulernabilities but for a grandma who wants to
keep her internet traffic out of the prying eyes of a 13 year old at
starbucks, I think it works.

For a corporate scenario pptp might not fit the security bill, but when
ease of use is more important than hiding from the CIA it works.

-Ken

> 
> -matt
> 
> Michael Mee wrote:
> 
> > Toby Martin wrote:
> >
> >> What's wrong with the user doing end-to-end encryption with ssh and ssl?
> >
> >
> > How does your mother work out how to set this up? (to use the classic 
> > example).  Even WEP is too complicated for most folks to configure 
> > (plus they mis-type the strings). I postulate that PPPTP is pretty 
> > simple by comparison, However I'm hoping others may have had some 
> > experience with this and have some insights on whether this works or 
> > what other approaches might be better.
> >
> > The goal is to:
> > + prevent simple traffic sniffing / monitoring attempts (think ethereal)
> > + make it easy enough for most users to configure themselves
> >
> > Thanks!
> >
> > cheers, michael
> > _______________________________________________
> > Dev mailing list
> > [email protected]
> > http://seattlewireless.net/mailman/listinfo/dev
> 
> 
> _______________________________________________
> Dev mailing list
> [email protected]
> http://seattlewireless.net/mailman/listinfo/dev

_______________________________________________
Dev mailing list
[email protected]
http://seattlewireless.net/mailman/listinfo/dev