5 ms·

What's silly about Digest?

• tptacek 18y ago
  It's obviously less secure than SSL.
  • thaumaturgy 18y ago
    DAA isn't intended to solve the same problem as SSL. SSL also isn't always worth the cost of the certificate, depending on the information being guarded; nor is it absolutely secure [http://eprint.iacr.org/2004/111.pdf http://eprint.iacr.org/2004/111.pdf, May 2004]. I don't understand the all-or-none attitude that appears to be prevalent in the security industry. For all the discussion spent on search spaces, and maximizing attack effort, there doesn't seem to be much acceptance for "good enough" security. There appears to be this attitude that -- to use wireless security as one example -- "WEP is broken, so you might as well just run a totally open network." I see that when you say that anybody that can sniff traffic for stupid JavaScript hashes can also necessarily inject traffic to alter the negotiation between the host and the client. While in theory that's correct, in practice it ignores the difference in the number of people that know enough to execute either attack. It makes sense to say, "If you're going to do password encryption, you might as well do it right", but I don't think it follows that even a stupid JavaScript MD5 hashing scheme is as insecure as plain-text password transmission.
    • tptacek 18y ago
      The paper you linked to, which I just got around to looking at, has no bearing whatsoever on the security of SSL for password security. It was also never, so far as I can tell, published.
  • deleted 18y ago
    [deleted]