5 ms·
EFF's 2011 Holiday Wish List
- drx 15y agoMust be cool for Colin to have Tarsnap featured there (as secure backup provider Tarsnap puts it, "[b]ackups are supposed to be a tool for mitigating damage — not a potential vulnerability to worry about!")
- marquis 15y agoRegarding "All software downloads should be provided only over HTTPS", this is very expensive to provide, but is allowing users to compare a checksum an equally secure option?
- jpiasetz 15y agoWhat's to stop someone in the middle changing the checksum on the page?
- fuzzmeister 15y agoThe download page could still be served via HTTPS, even if the download itself isn't.
- nodata 15y agoThe checksum is normally gpg signed.
- MikeCapone 15y agoBy expensive you mean in CPU cycles, right? Isn't it becoming less expensive all the time thanks to Moore's Law? Is it really all that expensive these days? (I'm really asking because I don't know, this isn't rethorical.)
- marquis 15y agoYes, CPU cycles is the most expensive. Great discussion here on Stackoverflow: http://stackoverflow.com/questions/149274/http-vs-https-performance http://stackoverflow.com/questions/149274/http-vs-https-perf...
- alexchamberlain 15y agoCould this be mitigated by using some form of hardware accelration on servers?
- davorak 15y agoNot a security expert here but it seem like akamai should also be required to use a root CA that does not use md5 for it's encryption. It am under the impression that md5 based encryption has been broken since 2008: http://www.win.tue.nl/hashclash/rogue-ca/#sec71 http://www.win.tue.nl/hashclash/rogue-ca/#sec71
- ordinary 15y agoMD5 is not an encryption algorithm. It is a hashing algorithm. You're right though, it is broken.
- Dylan16807 15y agoThe authentication is based on encrypting said hash, so I would say that md5-based is good enough as a description.