4 ms·

> Nobody says it's different They why do all the extra work for no gain in security? I think the sibling comment address your next comment well.

• bartbutler 10y ago
  There's a difference between an active attacker and a passive MITM attacker. Doing this for the web app in addition to the native apps helps prevent a passive MITM attack from stealing login credentials.
  • jimktrains2 10y ago
    A mitm is an active attacker. If TLS fails, then the mitm could modify the code sent to the end user.
    • bartbutler 10y ago
      That's a limited definition of MITM. That would be an active attack, and yes, this does nothing for that for the web app--the native apps are a different story. However, there are plenty of corporate PCs and other machines with root certs installed in a way that a third party could, and often does, passively record traffic without modification for analysis later. SRP prevents those dumps from containing information that can be used to compromise an account.
      • jimktrains2 10y ago
        That is exactly what I'm describing though. The corporation could edit the page to do what they want. To claim otherwise is foolish and really makes me question proton's understanding of security.