Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 15 Feb 2016 22:13:30 +0300
Subject: Re: Browser Security Tool: HTTPS Only (Why, How, Open Source, Python)

On 2016-02-14 22:07:21 -0500, David Leo wrote:

 > This tool completely locks browser - just HTTPS, nothing else.

That means, it causes effective DoS with "ssl_error_no_cypher_overlap"
(as it's called by Firefox) for approx. 60% of all sites.

In most cases, HTTPS is either misused or abused. But the ${subject}
does both misuse and abuse: it forces HTTPS even for unauthenticated
connections (are there any real reasons to use HTTPS instead of E2EE
for protecting the information which is publicly available?), while
not making any use of a clients' certificates.

Ds: PoS
Rp: >& /dev/null

Alexey V. Vissarionov aka Gremlin from Kremlin
GPG: 8832FE9FA791F7968AC96E4E909DAC45EF3B1FA8

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.