4 ms·
If TLS is broken, the world has bigger problems. And then they could simply intercept the session cookie either way.
by 0x0 6y ago
If TLS is broken, the world has bigger problems. And then they could simply intercept the session cookie either way.
- ryukafalz 6y agoThe session cookie isn’t a potentially reused human-readable string though. The password is.
- arghwhat 6y agoIf TLS was broken, I would always be able to get your password by just removing the hashing from the login page. I'd also be able to modify all legitimate requests, and be able to obtain your genuine login tokens for any site.
- ryukafalz 6y agoThat requires an active attack though. Yes, that’s always possible if TLS is broken, but it takes more work and is detectable. (Not saying it’s easy to detect, but it’s detectable in theory, where passive sniffing is not.)
- arghwhat 6y agoIf TLS is broken, you lose all message authentication, rendering tampering entirely undetectable. Passive sniffing requires the same attack vector, and the idea of an attacker only utilizing passive attacks makes no sense. The point is that additional hashing designed for the premise of "broken TLS" fails the thread model test: It is pointless, as the only time it is applicable is when everything is fallen apart.
- Dylan16807 6y agoTLS itself doesn't have to be broken to have an interceptor.
- 0x0 6y agoIf your machine has TLS being intercepted nothing matters anymore. That would be the equivalent of having a keylogger installed. There's no point in trying to protect such a client anymore, it's game over then.
- Dylan16807 6y agoPassive interception happens. Especially when you're using a cipher that isn't forward-secure; a breach of the server could allow it to decrypt previous sessions.