Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of mearns.b@gmail.com designates
 209.85.132.244 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type:content-transfer-encoding;
        b=onVj2BUhVQEQ5I/2VqTv7ZxIS4YYgV3taOWXT/lUcCsw7Ywl8+UYUf0QYKByMrP5Mr
         ZBpz15k+HTsOnQ5gTOViqav6rRyB6dIzh2WX/kd/d6lPItD8vjGt9ep5urCr9ZUqn8TE
         +dRoRPHzinws1xRP++wDDVcOaV41PeDaX2C5Y=
MIME-Version: 1.0
In-Reply-To: <49804D02.3070908@ice-sa.com>
References: <4df3a1330901270526j6c566468l66f9e960c8e1b496@mail.gmail.com>
	 <4df3a1330901270702r55e84664rd1ebb7a0ae791937@mail.gmail.com>
	 <20090127183542.1451212f@grimnir>
	 <1233082149.20501.253.camel@mattlaptop2.local>
	 <4df3a1330901271116w6de8362el3bd273d6b4e605cf@mail.gmail.com>
	 <20090127193542.7cd0de35@grimnir>
	 <4df3a1330901271137g9e82ddal9ade24ac40326f2@mail.gmail.com>
	 <497F75D3.8010507@ice-sa.com>
	 <3BBAC469-0DDB-47C9-9A57-98D45FAC5AD3@webthing.com>
	 <49804D02.3070908@ice-sa.com>
Date: Wed, 28 Jan 2009 08:42:36 -0500
Message-ID: <4df3a1330901280542s69ab6079ofef989fe05d2fab8@mail.gmail.com>
From: Brian Mearns <mearns.b@gmail.com>
To: users@httpd.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: [users@httpd] IP-address spoofing a concern?

On Wed, Jan 28, 2009 at 7:18 AM, Andr=E9 Warnier <aw@ice-sa.com> wrote:
> Anyway, the OP did not sound like he was talking about an access to Fort
> Knox, although you never know..

Oh shoot! Now you've blown my cover! =3DJ

Man in the middle is what it is, I'm not really that concerned about
it because I'm not dealing with anything too critical. I just want to
provide some fairly robust security for a handful of users. I've got a
lot to work with from this conversation, which is good. Ultimately,
I'm going to leave it up to users whether or not they want to connect
with HTTPS, and make it clear that this is the only way to really
secure the session and data.

Thanks again,
-Brian

--=20
Feel free to contact me using PGP Encryption:
Key Id: 0x3AA70848
Available from: http://pgp.mit.edu/

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org