In article <9510010446.AA11983@dmsd.com>, jbass@dmsd.com (John L. Bass) writes:
Another is since the clients are often distributed over the net, that another filter is installed recognize clients and alter them on the fly to avoid the client/filter problem in the future.
This is kind of silly. If someone can patch the binary on the fly as you are downloading it, then all is lost, since they could just patch it to send them copies of any information they wanted.
Another tack is based on getting very close to the server (in a bridge or router in the direct path to the server) in which the filter might acutally be able to get the get valid certificates signed in the servers name, while eating the real requests.
I really don't understand what you are saying here. Do you mean that you could intercept a real server's certificate request, and substitute your own private key, and then intercept the response? This could be easily detected by the CA and the server operator, and I think is just a policy issue for the CA. --Jeff -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw@netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.