On Wed, Jun 17, 2009 at 10:17:53PM +0200, Andy Bierman wrote:
The all-or-nothing approach actually helps hackers.
If there is no filter, then any dropped notification
would stick out like a red flag, since it must have
contained some sensitive data. (This works just
by watching the traffic with wireshark, without
actually being able to read any of the packets.)
We should want to make it as difficult as possible
to discover the access control policy in use on an agent.
I hope SSH makes it difficult enough to do this kind of attack; an
attacker would need a valid session key to make any sense out of the
encrypted byte stream. And if the attacker is able to obtain a valid
session key, well then you likely have a bigger problem.
