[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 2 May 2015 11:27:35 +0100
From: Eddie Chapman <eddie@...k.net>
To: mancha1@...o.com
Cc: oss-security@...ts.openwall.com
Subject: Re: On sanctioned MITMs
On 02/05/15 00:39, mancha wrote:
> Those are good suggestions for service providers seeking to outsource
> part of their processes but not so relevant to grandma e-banking or
> checking her medical results from her chalet in the Swiss Alps. As
> grannie is finding out, more and more sensitive transactions are being
> conducted over HTTPS these days. So, she's happy when she sees a lock in
> the url bar and gets no alerts from Firefox.
Despite whatever infrastructure and other real world challenges a
company/organisation faces, what you write above is the most important
issue. When we all see the lock in the URL bar, we expect and hope that
the communications between our browser and the company/organisation is
encrypted *all the way* to the company/org we identify in the URL.
This is a fundamental issue of trust which cannot be broken at all
costs, even if it means more disruption to services. There is very
little trust left out there and we cannot afford to erode it further, as
this is more damaging than less service availability.
Apologies for continuing the off topic nature of this thread.
Eddie
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
