3 ms·
If it's "TLS-Protected data" then how can it be intercepted? I thought the idea behind TLS is to protect data on the wire. The only way I can think TLS would be
by spaceboy 10y ago
If it's "TLS-Protected data" then how can it be intercepted? I thought the idea behind TLS is to protect data on the wire. The only way I can think TLS would be intercepted is if a rogue certificate was placed somewhere
- tialaramex 10y agoMathematics lets us solve most of the problems of how to communicate securely at a distance, but one it can't tackle. Who are we communicating with? In TLS this problem is left to one or more trusted third parties, the Certificate Authorities. But, which CAs should we trust? Developers of an application using TLS have to make this choice, but they may not do a very good job. Worse, they may not even realise they were supposed to make a choice at all. For Safari the decisions are being made by some bunch of Apple engineers who hopefully know a lot about TLS and trust. For Firefox, the decisions are made in public, anyone can help Mozilla make policy, both experts and amateurs are welcome to bring their insight. But for some random iOS app, the decision was probably made by some guy with no specialist knowledge, copy-pasting examples they found with Google. Now, if they pick "Only trust Symantec's public CA" and six months later their company tries to switch from Symantec to Comodo, they'll soon realise their goof. It may cost them a lot of money, but no real harm was done. But what if they pick "Just trust anybody"? Well, everything _seems_ fine. It all works, the data is encrypted, there's no outward sign that anything is wrong. Until a bad guy makes their own CA (takes about five minutes) and issues whatever TLS certificates they want, which the app will accept happily and talk to the bad guy instead if they're able to intercept the network connection.