3 ms·
> An additional library e.g. OpenSSL (heartbleed), HTTPS crypto attacks (e.g. beast), an additional business processes that can be compromised both from the CA/
by witty_username 10y ago
> An additional library e.g. OpenSSL (heartbleed), HTTPS crypto attacks (e.g. beast), an additional business processes that can be compromised both from the CA/issuers standpoint and from the website admin POV, and an additional resource to protect and securely distribute(private keys).
If these things are attacked, your security is not worse than HTTP.
HPKP and HSTS fix the problems you've described.
- dogma1138 10y agoAgain you are talking about 2 different attack vectors here, the GP was talking about compromising the website, an attack against the traffic between the website and the client does not compromises the website in any case. And no if these things are attacked, at least as far as the library goes things aren't no worse than HTTP because it's a completely different threat scenario which can actually compromise the website/host rather than just poison a single client session. For example https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6309 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6309 which poentially allows for RCE if you use a vulnerable version of OpenSSL exposes your website to completely different threats than if you would only use HTTP, not worse, not better just an additional and quite different threat. This is why when you implement HTTPS or any other additional service you need to understand how it changes the attack surface of your service from both a technical and operational perspective.
- anonymfus 10y agoActually heartbleed was a lot worse than using HTTP: attacker could steel everything in the RAM of the server with vulnerable OpenSSL.