June 2009
Beginner
260 pages
5h 40m
English
Content preview from The Myths of SecurityBecome an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
Chapter 31. Are Man-in-the-Middle Attacks a Myth?
About seven years ago, someone I know proved to me that you could get pretty much any software you wanted for free, if it was sold through PayPal. All a bad guy had to do was copy the web page that sold the software and change the price on it. Then, when the bad guy clicked on his own malicious copy, it would go back to PayPal. If the vendor didn’t use a special PayPal system (where PayPal connected to the merchant over SSL to confirm the transaction), then PayPal just trusted that the price was real.
I don’t know about now, but back then nobody really used this system. And if they had, it wouldn’t have made much difference, because unless you were a big cryptography geek, you’d be using the PayPal sample code. And, I noticed that PayPal’s code didn’t show how to secure the SSL connection properly. If you followed PayPal’s lead, it would end up being easy to perform a man-in-the-middle attack on the connection (I’ll give a brief explanation later for those who don’t know the term). I pointed all this out to Max Levchin, founder and (at the time) CTO of PayPal. He didn’t seem to believe it was a real issue, and certainly didn’t think it was important, because none of his merchants seemed to care about security. Citing merchant apathy is a fair response, actually.
And then the original guy who contacted me decided to get the story some press coverage, and a Wired reporter was soon calling me for comment. I told him what I knew, and he ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.