5 ms·
"is now powering Chromium (on nearly all platforms), Android M and Google's production services" Does it means you can exploit more easily Google's backend sin
by Thaxll 11y ago
"is now powering Chromium (on nearly all platforms), Android M and Google's production services"
Does it means you can exploit more easily Google's backend since the code is opensource?
- mehta 11y agoOpenSSL as you can guess is also open source. Having boringssl opensourced does not change anything.
- Thaxll 11y agoWho knows that google was using OpenSSL?
- aruss 11y agoThe security of a system should never rely on an attacker not knowing the details of the algorithm or implementation. https://en.wikipedia.org/wiki/Security_through_obscurity https://en.wikipedia.org/wiki/Security_through_obscurity
- wolf550e 11y agoIt is possible to fingerprint a TLS stack using its behaviour that a sysadmin can't change. People knew it was openssl.
- icebraining 11y agoGoogle hadn't been using OpenSSL for most of their services; in fact, they discovered Heartbleed when studying the possible transition to OpenSSL from NSS; they ended up transitioning directly to BoringSSL. This doesn't detract from your point, since NSS is also open source, it's just a factoid.