3 ms·
The problem with 'may' is that a network intermediary might block TLS connections to ocsp.apple.com knowing it would fall back to plaintext. Apple could encryp
by angry_octet 6y ago
The problem with 'may' is that a network intermediary might block TLS connections to ocsp.apple.com knowing it would fall back to plaintext.
Apple could encrypt the payload though, using the Apple public key, which would solve the snooping by intermediaries problem.
- sneak 6y agoA network intermediary blocking or altering the TLS is an active attack. Plain HTTP is also vulnerable to that, so unauthenticated TLS is no worse than the current situation. TLS encrypts the payload just fine if you want that. That’s what TLS is for. PS: You don’t encrypt something to someone else using your own public key.
- angry_octet 6y agoI'm talking about when they block just the ocsp host TLS port. Heaps of places whitelist https for particular sites, and inspect the content to prevent TLS. Appliances that block TLS via packet inspection are dime a dozen. But the query/response fields can be an opaque encrypted blob and it would get through. Every Apple device obviously has the Apple pub key, and hence they can send encrypted messages back to Apple without needing any further PKI.