Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 2 May 2015 11:27:35 +0100
From: Eddie Chapman <eddie@...k.net>
To: mancha1@...o.com
Cc: oss-security@...ts.openwall.com
Subject: Re: On sanctioned MITMs

On 02/05/15 00:39, mancha wrote:
> Those are good suggestions for service providers seeking to outsource
> part of their processes but not so relevant to grandma e-banking or
> checking her medical results from her chalet in the Swiss Alps. As
> grannie is finding out, more and more sensitive transactions are being
> conducted over HTTPS these days. So, she's happy when she sees a lock in
> the url bar and gets no alerts from Firefox.

Despite whatever infrastructure and other real world challenges a 
company/organisation faces, what you write above is the most important 
issue. When we all see the lock in the URL bar, we expect and hope that 
the communications between our browser and the company/organisation is 
encrypted *all the way* to the company/org we identify in the URL.

This is a fundamental issue of trust which cannot be broken at all 
costs, even if it means more disruption to services. There is very 
little trust left out there and we cannot afford to erode it further, as 
this is more damaging than less service availability.

Apologies for continuing the off topic nature of this thread.

Eddie

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ