Date: Sat, 2 May 2015 11:27:35 +0100 From: Eddie Chapman <eddie@...k.net> To: mancha1@...o.com Cc: oss-security@...ts.openwall.com Subject: Re: On sanctioned MITMs On 02/05/15 00:39, mancha wrote: > Those are good suggestions for service providers seeking to outsource > part of their processes but not so relevant to grandma e-banking or > checking her medical results from her chalet in the Swiss Alps. As > grannie is finding out, more and more sensitive transactions are being > conducted over HTTPS these days. So, she's happy when she sees a lock in > the url bar and gets no alerts from Firefox. Despite whatever infrastructure and other real world challenges a company/organisation faces, what you write above is the most important issue. When we all see the lock in the URL bar, we expect and hope that the communications between our browser and the company/organisation is encrypted *all the way* to the company/org we identify in the URL. This is a fundamental issue of trust which cannot be broken at all costs, even if it means more disruption to services. There is very little trust left out there and we cannot afford to erode it further, as this is more damaging than less service availability. Apologies for continuing the off topic nature of this thread. Eddie
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ