Composing my thoughts at SFO airport
Ten days ago, it was announced that a serious weaknesses in WPA2 had been discovered. WPA2 is the protocol that secures all modern protected Wi-Fi networks. An attacker within physical range of a victim’s wifi network can exploit these weaknesses using key reinstallation attacks, or KRACK.
It should be noted that the discovered weaknesses are in the Wi-Fi standard itself, not in individual products.
Am I affected by KRACK?
KRACK is applicable to smartphones, laptops, tablets, and IoT devices. Vendors are still developing patches for KRACK.
ZDNet has a thorough listing of the patch status for large vendors.
KRACK Takeaways
- There are no confirmed reports of KRACK being actively used (yet).
- An attacker must be physically near a wifi network to deploy KRACK. In other words, attackers in foreign countries cannot use KRACK from afar.
- HTTPS web connections are still encrypted and safe. The same goes for email connections via TLS.
- Paubox is not affected by KRACK.
- Android phones and tablets are the most vulnerable to KRACK.
Seamless Encryption by Default
San Francisco to Los Angeles
The KRACK vulnerability points out the inherent weakness in using non-encrypted connections for email and web browsing.
It also validates our approach at Paubox: We designed our products from day one to employ a term we call seamless encryption.
In a nutshell, seamless encryption is about providing the expected benefit without requiring the end user to change their behavior. In this case, the expected benefit for our customers is HIPAA compliant email.
We believe our approach is sound and represents the eventual maturation of the internet.
SEE ALSO: KRACK Attack – What to Communicate
No comments:
Post a Comment