Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 26 Aug 2013 14:47:20 +0400
From: Alexander Cherepanov <>
Subject: Re: HTTPS

On 2013-08-15 10:38, wrote:
> On 14-Aug-2013 14:59:12 -0600, Kurt Seifried wrote:
>  > everyone should be enabling HTTPS where possible,

I agree.

> Very dangerous mistake. HTTPS should be used only for non-anonymous
> access, otherwise plain HTTP is preferred. 


I kinda shared this sentiment several years ago (when I used tools like
Privoxy for my personal content filtering) but not any more. The time
has changed. Wifi usage is widespread and more untrusted networks are
used in general, I think. ISPs are inserting ads in Web traffic [1][2].
Tor becomes more popular (and every exit node is in mitm position).
Projects like "HTTPS Everywhere" are gaining moment. And privacy is
taken much more seriously in general. And so on. And don't forget recent
(and not so recent) NSA spying scandals:-)


The situation with corporate networks could be somewhat different but
IMHO not very much.


>  > intercepting and modifying HTTP is trivial.
> Yes. But intercepting and modifying HTTPS requires just an ability
> to issue client-trusted certificates (sufficient for 99% of HTTPS
> applications), so the content signing should always be preferred
> over distributor validation.

Content signing by whom? Whose signature would you trust when you
install a random gem? Will you manually hunt keys for authors of all
packages and their dependencies, blindly trust any signatures, or what?

OTOH HTTPS prevents at least two attacks (by an attacker in mitm
position) that plain content signing doesn't:
- replay attack (downgrade to known-vulnerable version) [3];
- DoSing client by sending data forever in response to any file request [4].


But don't take me wrong, I'm not proposing to use HTTPS instead of code
signing at all. Both seem to complement each other rather well.


is there any description of the state-of-the-art approach to software

Alexander Cherepanov

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.