3 ms·
"If you were a large company with significant academic and engineering resources, you might instead want to design your own private secure protocol that: U
by fulafel 4y ago
"If you were a large company with significant academic and engineering resources, you might instead want to design your own private secure protocol that:
Uses encryption you control, so it cannot be bypassed by hacking the certificate authority,
Uses UDP to avoid having OS connection state on the server side, and
Uses a well-designed, known packet structure to improve throughput and reduce security vulnerabilities from HTTP/TLS parsing."
I think at this point they would have done well to explain why WebRTC data channels are not usable or incrementally fixable for the purpouse. It's SCTP tunneled in DTLS over UDP. Missing is just the home brewed encryption requirement which would generally be a no-no in security engineering practices.
- HWR_14 4y ago> Missing is just the home brewed encryption requirement which would generally be a no-no in security engineering practices. Maybe if the "large company" he talked about was the NSA/FSB/MI6/Chinese Intelligence it would make sense.
- Ekaros 4y agoFully forgetting that what ever they roll has to have state on server side, just this time in the server software... Not solving too much... And then forgetting the nice stuff TCP offers like in-order guaranteed delivery... Both which is needed for most sensible encryption schemes. And doesn't really get away from needing a PKI... Or then you could just grab a connection before it is formed. If you can MitM HTTPS you can MitM anything else...