Basic Communication Protection

SSL/TLS is used to establish an encrypted communication channel

• https

How does it work

• Browser obtains cert of the website

• secret key is established using the cert

• all traffic is encrypted

TLS Handshake

• Specify which version

• Decide cipher

• Authenticate using public key and SSL cert

• Generate session key after handshake is complete

• Asymmetric used for handshake, symmetric used after handshake

  • symmetric is faster, asymm is more secure

  • asymm for key exchange, symm after for speed

Man-in-the-Middle Attack

• Attacker intercepts the key exchange and poses as each party to the other

• TLS cannot prevent MITM but can detect

VPN

• SSL/TLS only protects contents not activities

• User connects to VPN to protect activities

Advantages

• Anonymity

Limitations

• Not free

• VPN server can still see what youre doing

Tor

• Tor replaces one VPN server with multiple to preserve privacy

Pros

• extra privacy

Cons

• Extra cost