4 ms·
Ask HN: How common or plausible are TLS MITM attacks?
In building a financial app, I've been thinking constantly about security. Ultimately everything comes back to TLS. If that's able to be compromised, there's almost no way I can think of to stay secure. How common or realistic is it to assume this could ever happen to my application?
- pitched 5y agoAssuming you aren’t certificate pinning, if someone gets access to the device unlocked for a moment, they can add their own cert to the device trust and you’re dead. This is a big deal if you’re building a kiosk type of thing but not so much if it’s a phone app. The better approach is to assume your app will get MITMed and reduce how much damage the attacker can do.
- xyzzy123 5y agoAssuming that TLS will not be broken in transit is a common and reasonable assumption. The easiest way to break TLS is at the endpoints. Implementation errors in your code, cert mis-issuance, errors in the underlying TLS implementation (certificate parsing and validation errors are quite common) and device compromise are all things to think about. It might be useful to think about what is your responsibility versus the device vendor's responsibility versus the user's responsibility.
- fffkkkhhh 5y ago@aphextron are you aphex from ytmnd?
- aphextron 5y agolol yeah wow, who is this?
- fffkkkhhh 5y agoewok come post at rubycalaber i miss you man dont be like doc and dissapear inside a super man comic http://www.rubycalaber.com/forums/forum.php http://www.rubycalaber.com/forums/forum.php or ttheredpenn@gmail.com
- fffkkkhhh 5y agohttps://discord.gg/pdJcTmH https://discord.gg/pdJcTmH oleNDER AND EPO AND THEM STREAM ON TWITCH but they dont talk to me but here is their discord incase they never invited you
- fffkkkhhh 5y agoepo nuts still has crush on that girl i banged 17 years ago and banns me when i try to join i got to use alt account lol
- fffkkkhhh 5y agoaphextron is that you alex come post at rubycalaber we havent heard from you in a while
- fffkkkhhh 5y agoyo aphextron is that you from ytnd? remeber us come post on the forum we miss you man searched your name and found you here, not sure why they keep deleting my message but its your long lost bro, come to ruby calaber forumnd post, im there, cANT POST number here, glad i found you!
- fffkkkhhh 5y agoyoyo aphextron its your brother was wondering where you been for last 4 year come talk to me email me or somethin ttheredpenn@gmail.com