> 90% of the time the desirable quality of TLS traffic is authentication of the server, not encryption.
> 90% of the time the desirable quality of TLS traffic is authentication of the server, not encryption. Authentication of the server is not sufficient, you also have to authenticate every message as having a valid checksum and signature. >Typical use case: software updates distributed as signed packages This is a specific use-case because the package checksums are verified before any of the code is executed (unlike injected javascript to webpages). Also the checksum is usually obtained from the package server, so if SSL is broken the checksum can be spoofed as well.
Posted by hurin on Feb 20, 2015, 1:27 AM
Tags
Related issues
- You obviously did this for fun, I don’t want to throw any shade on it and have no criticism, I also make fun things just because.¹ So ta...
- Many devs love to shit on the guy from the 'I just want the exe.
- Now imagine how poor people stress if their smartphone bricks or gets damaged or lost.
- Resuming an extended-thinking session fails permanently with 400 "thinking blocks cannot be modified" (transcript stores thinking text as empty but keeps signat
- I'll preface this with a statement that as a European I want European alternatives to succeed, and MS-owned GitHub to shrivel and disappear.
- Yeah, but there’s a world of difference between “not perfect” and “we rounded a few sliders, and now the modal is a nightmare to use”.
Raise real-world problems, find people facing the same issue, and discuss solutions.8,000 issues0 comments
reliability (SaaS)
You obviously did this for fun, I don’t want to throw any shade on it and have no criticism, I also make fun things just because.¹ So ta...
Many devs love to shit on the guy from the 'I just want the exe.
Now imagine how poor people stress if their smartphone bricks or gets damaged or lost.
Resuming an extended-thinking session fails permanently with 400 "thinking blocks cannot be modified" (transcript stores thinking text as empty but keeps signat
I'll preface this with a statement that as a European I want European alternatives to succeed, and MS-owned GitHub to shrivel and disappear.
Yeah, but there’s a world of difference between “not perfect” and “we rounded a few sliders, and now the modal is a nightmare to use”.
I used to write a lot of native Windows corporate software in the 90's and 2000's and my standard login window was a floating draggable o...
App broken with Mosquitto broker 7.0.0
> 90% of the time the desirable quality of TLS traffic is authentication of the server, not encryption.
> 90% of the time the desirable quality of TLS traffic is authentication of the server, not encryption. Authentication of the server is not sufficient, you also have to authenticate every message as having a valid checksum and signature. >Typical use case: software updates distributed as signed packages This is a specific use-case because the package checksums are verified before any of the code is executed (unlike injected javascript to webpages). Also the checksum is usually obtained from the package server, so if SSL is broken the checksum can be spoofed as well.
Comments (0)
No comments yet. Start the discussion.