RE: RPC over HTTP security

From: Paris E. Stone (pstone_at_alhurra.com)
Date: 01/28/05

  • Next message: Shawn Wall: "RE: Exchange <--> Outlook Monitoring" 
    Date: Fri, 28 Jan 2005 14:36:40 -0500
To: "Shawn Wall" <sjwall@shaw.ca>, "Eric McCarty" <eric@piteduncan.com>, "Kevin Doheny" <kdoheny@CNP.net>, <sf_mail_sbm@yahoo.com>, <security-basics@securityfocus.com>

    Maybe he means there is no Authentication to HTTPS?

    Anyone can type https:// and accept a certificate.

    All that does is make the traffic past that point illegible to an IDS,
    etc....

    -----Original Message-----
    From: Shawn Wall [mailto:sjwall@shaw.ca]
    Sent: Friday, January 28, 2005 12:54 PM
    To: 'Eric McCarty'; 'Kevin Doheny'; sf_mail_sbm@yahoo.com;
    security-basics@securityfocus.com
    Subject: RE: RPC over HTTP security

    I'd have to agree with Eric on this one. SSL is a proven encryption
    method.
    Billions of dollars are transefer via SSL encypted sites every year. If
    was
    as trivial to 'hack' as you suggest, Kevin, I don't think it would be in
    use. Perhaps you could do as Eric suggested and provide some factual
    proof.

    shawn

    -----Original Message-----
    From: Eric McCarty [mailto:eric@piteduncan.com]
    Sent: Friday, January 28, 2005 10:35 AM
    To: Kevin Doheny; Shawn Wall; sf_mail_sbm@yahoo.com;
    security-basics@securityfocus.com
    Subject: RE: RPC over HTTP security

    Your joking right.

    "SSL in and of itself provides very little security"

    That's why most of the internet uses it right?.

    Your gonna have to back up statements like yours with some serious
    factual
    backing otherwise your comments will be discarded as B.S coming form
    someone
    who doesn't know what they are talking about.

    E.

    -----Original Message-----
    From: Kevin Doheny [mailto:kdoheny@CNP.net]
    Sent: Friday, January 28, 2005 5:06 AM
    To: Shawn Wall; sf_mail_sbm@yahoo.com; security-basics@securityfocus.com
    Subject: RE: RPC over HTTP security

    SSL in and of itself provides very little security... Way to easy to
    hack.
    Look into a Neoteris (now Juniper) SSL VPN/Proxy. This way evil hack3r
    can
    not ride the SSL stream into your network and past any IDS or IPS
    systems.

    Kevin

    -----Original Message-----
    From: Shawn Wall [mailto:sjwall@shaw.ca]
    Sent: Wednesday, January 26, 2005 11:04 PM
    To: sf_mail_sbm@yahoo.com; security-basics@securityfocus.com
    Subject: RE: RPC over HTTP security

    Are you using Exchange? Why not use OWA and secure it with SSL?

    shawn

    -----Original Message-----
    From: sf_mail_sbm@yahoo.com [mailto:sf_mail_sbm@yahoo.com]
    Sent: Wednesday, January 26, 2005 6:03 AM
    To: security-basics@securityfocus.com
    Subject: RPC over HTTP security

    Hi List,
    We are thinking about deploying RPC over HTTP to access email from the
    Internet

    Wanted to get some information on the technology and the security
    implications of same

    Not much info from Microsoft's site

    any help would be greatly apreciated

    Thanks,
    Ronish

  • Next message: Shawn Wall: "RE: Exchange <--> Outlook Monitoring"

    Relevant Pages

    • Re: RPC Over HTTP (External)
      ... Oh Ok no SSL ... causing the RPC proxy server not to trust the connection. ... i set use HTTP first for fast connection. ...
      (microsoft.public.exchange.admin)
    • Re: Exchange 2003: RPC over HTTP
      ... Note While RPC over HTTP does not require SSL, ... On the RPC Proxy server, ...
      (microsoft.public.exchange.setup)
    • RE: RPC over HTTP security
      ... SEF 7? ... Subject: RPC over HTTP security ... SSL in and of itself provides very little security... ...
      (Security-Basics)
    • RE: RPC over HTTP security
      ... Subject: RPC over HTTP security ... probably trillions of dollars are transacted via SSL. ... not offer the server much security, if anything it reduces it for the server ...
      (Security-Basics)
    • RE: RPC over HTTP security
      ... Never knew SSL was so secure.. ... Subject: RPC over HTTP security ... Why not use OWA and secure it with SSL? ...
      (Security-Basics)