3 ms·
HSTS was created specifically to prevent the MITM from downgrading HTTPS to HTTP. As for MITM blocking a protocol, that is a noticeable situation, and one that
by rocqua 9y ago
HSTS was created specifically to prevent the MITM from downgrading HTTPS to HTTP.
As for MITM blocking a protocol, that is a noticeable situation, and one that does not give the attacker any control over the cryptography used on sensitive data.
A downgrade attack is very different from blocking a protocol. The user doesn't notice, and the attacker gains some control over the cryptography used.
In the end, what sense does it make to have a TLS version an attacker can opt out of? All you get is defence against passive MitM. Until we aren't safe against those passive MitM with TLS 1.2 it makes no sense to rush TLS 1.3.
Especially because that rush would really hurt when it turns our TLS 1.2 is insecure, at which point the rushed solution becomes vulnerable to all active MitM attacks.
Now consider, what level of access to infrastructure only allows for passive MitM?
- wav-part 9y ago> The user doesn't notice, and the attacker gains some control over the cryptography used. In my case user will because the tls client wont accept insecure version request. Connection broken. Client will notify the user of server still using a insecure version. I think this might be the misunderstanding: A good client/server never establish/accept insecure versions. Yes MITM gets to pick but if he picks insecure version, there is no connection. POODLE was never attack on the protocol but poor implementations.
- syncsynchalt 9y agoOne misunderstanding is that you are accepting as fact that TLS 1.2 is secure, when it's entirely plausible that one or more state actors already know that not to be the case. There's no magic light that goes on when the NSA breaks TLS 1.2 so that we know to stop trusting it.