5 ms·
> Https (reasonably) guarantees confidentiality and integrity of the connection to the server, nothing more and nothing less. Nah, this is pretty wrong. It wou
by throwaway613834 9y ago
> Https (reasonably) guarantees confidentiality and integrity of the connection to the server, nothing more and nothing less.
Nah, this is pretty wrong. It would be pretty useless (if not dangerous) if that were all it did. The most important thing it establishes is the server's authenticity, i.e. you don't want a tamper-proof and confidential connecting with the wrong server! And moreover, once you can guarantee authenticity, the rest are secondary since they're easy to subsequently establish via key exchange and hashing.
- lucb1e 9y agoOh, yes, authenticity. You're right, that's a third feature! Still, it doesn't say anything about whether the website left the metaphorical hinges on the outside (i.e. has other security issues, such as XSS).
- poizan42 9y agoCan you really ensure confidentiality without authenticity though? Seems like you inherently are susceptible to MITM attacks without authenticity. Are there examples of the former without the latter?
- lucb1e 9y agoWith guaranteed confidentiality, you know it's confidential between you and the other party. Who that other party is however... so yeah, I see your point. I'm not sure if there's really a case for keeping these two separate, but that's how it's currently taught in schools (at least in the Netherlands).