4 ms·

tls is "state of the art" for a public server to talk to unknown users. but basically totally broken by design. http://www.interworx.com/community/is-ssl-tls-

by mSparks 10y ago

tls is "state of the art" for a public server to talk to unknown users. but basically totally broken by design. http://www.interworx.com/community/is-ssl-tls-broken/ http://www.interworx.com/community/is-ssl-tls-broken/ further tls:sender,recipient and server can read the message end to end:only sender and reciever can read the messages even though a sever facilitates connecting them to each other.

AlexCoventry 10y ago
> but basically totally broken by design. > http://www.interworx.com/community/is-ssl-tls-broken/ Can you please excerpt some quotes from that article which support that claim?
- mSparks 10y ago
  "That’s worrying, but in practical terms, it’s unlikely to have significantly impacted the security of TLS because the elliptic curve random number generator in question is not often used." vs. http://www.loyalty.org/~schoen/rsa/ http://www.loyalty.org/~schoen/rsa/ "Secondly, there’s the implementation. This is a bit more tricky because there’s plenty of scope for influencing either the software implementations or the standards upon which that implementation is based." vs. http://www.theregister.co.uk/2015/09/15/still_200k_iot_heartbleed_vulns/ http://www.theregister.co.uk/2015/09/15/still_200k_iot_heart... And if you think the vulnerabilities of the shocking state of openssl stop at heartbleed (which is as obvious as backdoors get), you've obviously not given the code even a cursory glance over. https obviously greater than http But if you trust it with your life you wont have a life. It's as simple as that. (and tls is basic compared to tor, and even that we have seen is broken to hell and back, or silkroad would still be running.) Signal and especially OTR are the current state of the art. Apple went the security by obscurity route and once again proved it's inferior.

by mSparks 10y ago

AlexCoventry 10y ago

> but basically totally broken by design. > http://www.interworx.com/community/is-ssl-tls-broken/ Can you please excerpt some quotes from that article which support that claim?

mSparks 10y ago
"That’s worrying, but in practical terms, it’s unlikely to have significantly impacted the security of TLS because the elliptic curve random number generator in question is not often used." vs. http://www.loyalty.org/~schoen/rsa/ http://www.loyalty.org/~schoen/rsa/ "Secondly, there’s the implementation. This is a bit more tricky because there’s plenty of scope for influencing either the software implementations or the standards upon which that implementation is based." vs. http://www.theregister.co.uk/2015/09/15/still_200k_iot_heartbleed_vulns/ http://www.theregister.co.uk/2015/09/15/still_200k_iot_heart... And if you think the vulnerabilities of the shocking state of openssl stop at heartbleed (which is as obvious as backdoors get), you've obviously not given the code even a cursory glance over. https obviously greater than http But if you trust it with your life you wont have a life. It's as simple as that. (and tls is basic compared to tor, and even that we have seen is broken to hell and back, or silkroad would still be running.) Signal and especially OTR are the current state of the art. Apple went the security by obscurity route and once again proved it's inferior.