3 ms·
I mentioned this in another thread, but given a secure way to acquire public keys, MITM attacks can be fully mitigated with signatures rather than payload encry
by samatman 5y ago
I mentioned this in another thread, but given a secure way to acquire public keys, MITM attacks can be fully mitigated with signatures rather than payload encryption.
A tiny client doesn't have to bother checking this signature, anything capable of receiving encrypted data could be just as sure that the payload is byte-identical with the author's intention as TLS makes possible.
The difference is everyone gets to read your postcard if they want, but I'm with you: if I have an AVR barely able to GET the weather report, and strip numbers out of it if the JSON schema doesn't change even slightly, what problem is going to arise from some bad actor reading that packet on the way in?
If Mallory starts messing with my dumb Arduino garden I can set up a firewall that checks the signatures. It's progressive enhancement with graceful degradation.