Talk:Man-in-the-middle attack/Archive 2

Archive 1

Archive 2

Gender Neutrality

The heading was originally "Neutrality" which explains the wording in some of the following comments. The heading was changed on 04:00, 17 January 2022. Johnuniq (talk) 04:30, 17 January 2022 (UTC)

Articles like these should generally use gender-neutral pronouns in its example(s) —CrafterNova ^{[ talk ]} 10:42, 13 January 2022 (UTC)

Please give examples of what you mean. What text in the article should be changed to what? There is no mention of "gender" or "pronoun" at WP:NPOV. Johnuniq (talk) 03:28, 14 January 2022 (UTC)

@Johnuniq: Only binary pronouns "he and "she" are use here. Since gender is not binary, and the examples mentioned are general situations, Singular they pronoun should be used. If consensus is reached, we can replace "he" and "she" with "they/them".

There are mentions of gender neutral language at MOS:GNL. —CrafterNova ^{[ talk ]} 05:40, 14 January 2022 (UTC)

MOS:GNL says something quite different from what you appear to think. At any rate, we agree that WP:NPOV is not relevant so a neutrality tag is inappropriate. The Scientific American article linked to above likewise says nothing about pronouns. By the logic above, the words "he" and "she" would need to be removed from all articles unless an appropriate authority had declared that they were genetically sound. Johnuniq (talk) 05:57, 14 January 2022 (UTC)

@Johnuniq:That Scientfic American article doesn't have to explain pronouns because Singular they already explains accurately. A related article is neopronouns. We don't have to remove "he" and "she" from all articles. I mean to imply that primary articles and examples which explain general situations should use they/them pronouns. —CrafterNova ^{[ talk ]} 06:13, 14 January 2022 (UTC)

Why mention Scientific American if it doesn't say anything about the use of he/she in this article? Are you aware that WP:PRIMARYTOPIC concerns disambiguation pages and similarly has nothing to do with pronouns? Johnuniq (talk) 06:57, 14 January 2022 (UTC)

There are more than "2 genders". I'm talking about inclusion of LGBTQ+ people in all articles. The WikiProject LGBT studies is meant to increase coverage of LGBTQ+ people and relevant content in all articles. I meant that primary topics should also be gender-neutral. I mentioned Scientific American to prove that gender is not binary and hence non-binary and genderqueer people are real and normal people. If needed, here's another source providing substantial evidence. Always simply using they/them pronouns in general examples and in cases of ambiguity helps in avoiding confusion. No wonder why LGBTQ+ people feel discouraged to edit Wikipedia. They should also be given freedom and encouraged to be Wikipedians. I thought this was easy to understand —CrafterNova ^{[ TALK ]  [ CONT ]} 07:10, 14 January 2022 (UTC)

Alice and Bob are commonly used, well established characters used to illustrate examples in cryptography. Their pronouns and antecedents are similarly well established. This is an article on cryptography. I see no problem with following the widely accepted conventions of the field. I do not agree that substituting they/them would avoid confusion; in my opinion if anything that would add confusion. I suggest that the simplicity of Bob and Alice and their pronouns has been helpful in illustrating what are often complex, abstract protocols and attacks. I appreciate that real people have more than two genders, and I personally celebrate this diversity. Bob and Alice are not real people; they are fictional characters, used merely for purposes of illustration. I agree that WP:NPOV is not relevant here (nor is MOS:GNL). Can we move forward and remove the tag? Cloudjpk (talk) 02:43, 15 January 2022 (UTC)

@Cloudjpk: It's systemic bias towards transgender people, queer people and non-binary people. As in the above context, there are baseless assumptions that "fictional characters should/can be binary only". Fictional characters can also have any sex and gender just like real people. Fiction has to be similar to real life, and if it's morally inclusive, it has positive impacts on culture. It's been disappointing for a long time that LGBTQ+ people are under-represented in fiction, cinema and culture. Gender doesn't matter in real life it shouldn't matter in fiction either. All you are trying to do is make excuses about maintaining grammar and saying "Bob and Alice are well established characters" when LGBTQ+ characters can be just as well established or even better. Many franchises like Marvel and DC comics include LGBTQ+ characters. —CrafterNova ^{[ TALK ]  [ CONT ]} 04:35, 17 January 2022 (UTC)

@Cloudjpk: Please elaborate how using they/them pronouns would "add confusion" —CrafterNova ^{[ TALK ]  [ CONT ]} 14:03, 15 January 2022 (UTC)

Compare "they sent to them, and they received it" with "she sent to him and he received it". Which one identifies sender and receiver? Cloudjpk (talk) 18:59, 15 January 2022 (UTC)

@Cloudjpk: For making grammar valid in a sentence such as the example "they sent to them, and they received it" you provided, we should use they/them pronouns in place of "he" and "she", rather than replacing "name(s)" with "they/them". Instead you replaced names of all individuals with "they/them" which obviously wouldn't make sense. That's being absent-minded. —CrafterNova ^{[ TALK ]  [ CONT ]} 04:43, 16 January 2022 (UTC)

Compare "Bob sent to Alice and Eric and they received it" with "Bob sent to Alice and Eric and she received it". Which one identifies the receiver unambiguously? Cloudjpk (talk) 07:53, 17 January 2022 (UTC)

@Cloudjpk: If both of them received the message, then "Bob sent to Alice and Eric and they received it" is accurate. If the message was received by Alice, then "Bob sent to Alice and Eric and Alice received it" is accurate. Basically what I'm saying is that if a character is non-binary, then their name has to be repeated when using "they/them" causes ambiguity. Otherwise, if not ambiguous, they/them pronouns should be used whenever mentioning them. It seems that you just don't want to accept the notion that fictional characters can be non-binary as well. —CrafterNova ^{[ TALK ]  [ CONT ]} 08:03, 17 January 2022 (UTC)

"If a character is non-binary, then their name has to be repeated to avoid ambiguity." I agree. Indeed if you repeat all names then no pronouns are needed whatsoever, and the issue disappears entirely. That too is an option. The tradeoff is diction and euphony. Cloudjpk (talk) 08:14, 17 January 2022 (UTC)

@Cloudjpk: There's one more thing that I just remembered just now. Neopronouns are used to mention non-binary individuals. So instead of "he and she", ze/zir/zem pronouns can be used. —CrafterNova ^{[ TALK ]  [ CONT ]} 08:48, 17 January 2022 (UTC)

"Bob sent to Alice and Eric and ze received it"; who received it?

I find I like the idea of neopronouns very much. Illustrating complex messaging protocols is not the problem they are designed to solve. Cloudjpk (talk) 18:26, 19 January 2022 (UTC)

@Cloudjpk: All sarcasm aside, neopronouns are just as simple as all pronouns. Since gender doesn't matter anywhere, than why do "gendered names" have to be used for illustration of complex message protocols? If names can't have any gender, then Bob, Alice, Eric, Mallory, etc. can be anyone's names. Can be he/she/they/ze/sir/zem. I know that Bob's pronoun is "he" and Alice's pronoun is "she" by default or convention, but I don't understand why is it so important to mention genders of fictional characters which are being solely used for the purpose of examples in cryptographic communication. For example "Bob sent to Alice, Sarah and Eric and ze received it". Sarah can be given the ze pronoun. More names can be added and given random pronouns, and then those pronouns should be used for mentioning their respective characters by default. —CrafterNova ^{[ TALK ]  [ CONT ]} 18:45, 19 January 2022 (UTC)

It is what the field in question has standardized on, and we should follow what the sources do to minimize overall confusion. If/when the sources adopt 'ze', then we should as well, not before. While there are signs that technical terminology is growing to be more inclusive over time, we shouldn't be getting ahead of the sources. MrOllie (talk) 18:58, 19 January 2022 (UTC)

@MrOllie: Then either this article or the sources it cites are outdated. There are millions of non-binary computer scientists and they are still under-represented. Fiction has to catch up with reality or these examples in cryptographic communications (and other topics as well) will be unrecognizable in the next decade or so. Many reliable sources have adopted neopronouns like ze/zir/zem. (for example, this article says similar things, and since neopronouns are commonly used nowadays, use of only "he" and "she" has been questioned by the general public many times) So according what you say, this articles needs more citations from reliable sources. —CrafterNova ^{[ TALK ]  [ CONT ]} 19:12, 19 January 2022 (UTC)

If many reliable sources on this topic have adopted neopronouns, please provide some. I'd say around 5 papers about Man-in-the-middle attacks that refer to Alice and/or Bob as 'ze' would be sufficient. MrOllie (talk) 19:16, 19 January 2022 (UTC)

@MrOllie: Providing that many reliable citations will require much time. But any help would be very appreciated. It would be definitely better to do teamwork —CrafterNova ^{[ TALK ]  [ CONT ]} 20:01, 19 January 2022 (UTC)

Well, you said there were 'Many reliable sources', so I assumed you had them at hand already. - MrOllie (talk) 20:03, 19 January 2022 (UTC)

General rule: kindly don't assume stuff when it has not been implied directly. If there weren't reliable sources, I wouldn't have said that. Also, the sources shouldn't have to specifically say "Nowadays person-in-the-middle attacks commonly refer fictional characters with random neopronouns and all other pronouns". That statement is lame rhetoric. This is just cryptographic culture and cultures are temporary, therefore they always keep changing. —CrafterNova ^{[ TALK ]  [ CONT ]} 06:55, 21 January 2022 (UTC)

Agree with MrOllie; it is our task as editors to follow the sources. If there are papers about Man-in-the-middle attacks that refer to Alice or Bob as 'ze' please cite same. Thank you. Cloudjpk (talk) 07:40, 21 January 2022 (UTC)

I agree, if we find sources mentioning the same, even better. Otherwise, Wikipedia policies concerning neutrality (and gender-neutral language) have to be implemented effectively on the entire website. —CrafterNova ^{[ TALK ]  [ CONT ]} 07:54, 21 January 2022 (UTC)

Wikipedia policies concerning neutrality (and gender-neutral language) are fully complied with on this article. These are specific fictional characters that have established genders and may be referred to as such. MrOllie (talk) 13:29, 21 January 2022 (UTC)

These "specific fictional characters" can have any gender. You may be aware about the fact gender is never a choice. We don't have to be "establish" genders because genders are created by nature, as such, in the human gene pool and gene pools of several other organisms, hence the diversity, which in turn ensures survival of the biosphere. If some are still "not convinced", there are sources, and Wikipedia itself, which accept trans, genderqueer and non-binary characters in fiction. Now I hope consensus is reached. —CrafterNova ^{[ TALK ]  [ CONT ]} 17:10, 22 January 2022 (UTC)

No. It is not up to us to change the gender of these characters. The fact that some other character is nonbinary has no relevance here. MrOllie (talk) 17:16, 22 January 2022 (UTC)

@MrOllie:Rhetorical question: What if you were born transgender, queer and/or non-binary? Does implying that some people's genders are "not relevant here" sound ethical to you?

I had gone through the same dilemma 6 years ago. To be honest, it was difficult at first but easy now that I have made friends with those diverse people. I hope you and all Wikipedians do so too. —CrafterNova ^{[ TALK ]  [ CONT ]} 17:34, 22 January 2022 (UTC)

I don't think it is very ethical to cast aspersions on others in a discussion because they correctly note that your arguments are largely off topic. MrOllie (talk) 18:00, 22 January 2022 (UTC)

I don't understand how that was "an attack on someone's reputation". And you are just stalling this discussion by calling what I say "off-topic". Not very surprising —CrafterNova ^{[ TALK ]  [ CONT ]} 06:34, 26 January 2022 (UTC)

If you don't want conversations to be stalled, don't call other participants unethical. MrOllie (talk) 13:29, 26 January 2022 (UTC)

@MrOllie: I didn't call anyone unethical. That was a rhetorical question —CrafterNova ^{[ TALK ]  [ CONT ]} 13:33, 26 January 2022 (UTC)

Thinly disguising an insult as a 'rhetorical question' fools precisely no one. - MrOllie (talk) 13:38, 26 January 2022 (UTC)

@MrOllie: If you think that was "an insult", then you can report me. I'm not afraid ;) —CrafterNova ^{[ TALK ]  [ CONT ]} 13:41, 26 January 2022 (UTC)

Well, please don't imply that there are 'many reliable sources' when you don't have any. MrOllie (talk) 13:29, 21 January 2022 (UTC)

I said that because I'm sure there are, or I will make sure that there will be reliable sources. —CrafterNova ^{[ TALK ]  [ CONT ]} 17:01, 22 January 2022 (UTC)

Rename page to person-in-the-middle

I did my masters thesis on so called man-in-the-middle attacks but as I started my writeup realized I felt uncomfortable with this terminology. I switched to using 'person-in-the-middle' and felt like that was a more modern, gender-neutral approach. Forgive my wikipedia edit-culture/technological ignorance but would it be possible and/or desirable to rename this page to person-in-the middle and have a redirect from man-in-the-middle to here?

The first line of the article quotes the Australian Cyber Security Centre that personal-in-the-middle is (now) the preferred nomenclature.

Heavyimage (talk) 15:23, 18 May 2022 (UTC)

Wikipedia follows the common usage. When most sources adopt your preferred terminology, so will the Wikipedia article. Until that happens it will remain titled as it is. MrOllie (talk) 16:05, 18 May 2022 (UTC)

Example

Copied from my talk page. Refers to this revert. ~Kvng (talk) 14:46, 5 July 2022 (UTC)

Even if you would argue that the cited attack is a mitm (and by reverting you are, since it's not a claim by the source), you will grant that it's not a classic mitm, which makes it a bad candidate to lead an examples section.

I see lots of reasons it differs from a typical mitm attack:

1- The would be attacker is not in the middle, it does not relay information back and forth between both parties, there is no receiving party.

2- The would be attacker is not an eavesdropper, but a legitimate relay, the contents being read are headers, metadata, dns addresses. It's like a mailman reading the return address, not like a mailman breaking the envelope.

3- the would be attacker is not stealthy, it does not impersonate the intended recipient (there is no recipient).

To continue the mailman analogy, in a mitm, the mailman would need to break the envelope seal with vapour, inspect the contents of the envelope, optionally tamper the contents, reseal and deliver it, all of this in secret.

If you rerevert the edit, I'll fix turn that red link into blue, and perhaps we can find a more relevant example for the article. TZubiri (talk) 08:25, 5 July 2022 (UTC)

It is an WP:OR problem that the source does not identify this as a MITM situation. The attacker in this case is the router which is between the user and the web server they're connecting to. The router is eavesdropping, looking for a connection to happen and then it imitates the desired web server to redirect the user to an ad. ~Kvng (talk) 14:46, 5 July 2022 (UTC)

There is no web server to connect to because the domain name was not owned by anybody.

The router is not eavesdropping on the domain name, it is given that information in order to perform its task, the mailman doesn't snoop the routing addresses on the envelope. TZubiri (talk) 16:52, 5 July 2022 (UTC)

Re:OR. It's certainly easier when a source uses the same wording as the article, but I think there should be lots of sources that don't explicitly use this term. Citing a source that describes a mitm attack without naming it (or using a synonym of course) is fine. But let's try to keep it uncontendable. As soon as we start to disagree we will have to fall back on the word instead of the concept, which will end up with a safer article, but of much lower quality.

Let's just keep an eye open for a better example.

I'm familiar with a lot of sources regarding defense against hypothetical mitm ( again where the concept is so implicit that the word is never used), but I don't know any prominent examples of a breach. The most likely example I can think of is of an eavesdropper being an it admin in an office network, but a mitm here would be much less common.

I thought about those thin devices layered on top of credit card readers. But there's no modification of information there, just snooping. I think it qualifies as long as the relaying is an active effort, instead of literally being a passive wiretap. Relaying where an agent was entrusted to relay are also excluded.

The best examples though will have either surgical modification of content, like a bank account, or an active adaptation between contents or languages. TZubiri (talk) 17:21, 5 July 2022 (UTC)

One prominent example would be the Stingray phone tracker. I'm actually a bit surprised this article doesn't already mention it. MrOllie (talk) 17:33, 5 July 2022 (UTC)

Yes Stingray phone tracker is a good example for eavesdropping. ~Kvng (talk) 15:00, 8 July 2022 (UTC)

Thanks! Replaced the example with that one.--TZubiri (talk) 22:50, 8 July 2022 (UTC)

Anyone else open to including Stingray in addition to, not instead of the Belkin example? ~Kvng (talk) 14:40, 12 July 2022 (UTC)

Another reason to avoid Belkin is to avoid NPV issues wrt Net Neutrality.

You can add the *view* that it is a mitm there. TZubiri (talk) 02:36, 20 July 2022 (UTC)

Fake people

How do you determine your talking to the real person they're claiming to be 2600:6C58:7200:4246:8832:E308:B28B:10E (talk) 01:04, 26 October 2022 (UTC)

Using a digital signature is a popular approach. Secure communication prevents both eavesdropping and modification. ~Kvng (talk) 15:22, 28 October 2022 (UTC)

Read out loud for webpages

Can we add text to speech here? 2406:B400:D1:713B:948B:AEBD:3C80:B78B (talk) 20:34, 19 December 2022 (UTC)

Mention phishing?

For most people – although possibly not most readers of this article – the most relevant application is phishing of temporary login/authentication/signature keys. E.g., presenting a façade that looks like a legitimate "Verified by VISA" page, and relaying the codes to another VISA transaction than the user tries to do. Elias (talk) 06:21, 27 March 2023 (UTC)

Symantec implementing MITM for 'security' reasons

see:

https://docs.broadcom.com/doc/web-security-service-bring-control-to-the-chaos-of-the-cloud-en

Page 7 198.135.124.72 (talk) 09:08, 23 June 2023 (UTC)

https://docs.broadcom.com/doc/web-security-service-bring-control-to-the-chaos-of-the-cloud-en 36.37.198.225 (talk) 16:39, 24 July 2023 (UTC)

Server certificate pinning enhancement

May I add a Github link to my work about an enhancement to server certificate pinning to prevent MiTM attack? Not sure whether this violates Wikipedia's policy regarding external links. I got a warning while trying to add the link. Syang7081 (talk) 00:41, 24 June 2024 (UTC)

You can post it here for review. The guideline is WP:EL which has a fair bit of waffle but which boils down to an attempt to oppose the proliferation of external links because many of them are added for promotion. You are not WP:AUTOCONFIRMED and there is probably a filter to warn about posting a link. In general, an article would only have an external link if the topic at the target page was covered by a few reliable sources. Johnuniq (talk) 03:21, 24 June 2024 (UTC)

This is the Github link: https://github.com/syang7081/server-authentication. Thank you for your quick reply! Syang7081 (talk) 04:42, 24 June 2024 (UTC)