2 ms·
I am far from understanding the technical details. But it feels like they severly violated the rule of not running your own cryptography. If they had used TLS
by usr1106 3y ago
I am far from understanding the technical details.
But it feels like they severly violated the rule of not running your own cryptography. If they had used TLS the MITM would have been much less likely as long as the app does not accept user-defined cerificates?
- qweqwe14 3y agoSee my comment here: https://news.ycombinator.com/item?id=37790260 https://news.ycombinator.com/item?id=37790260
- lxgr 3y agoTLS is powerful, but not a fit for literally every scenario, especially if you have more than one, possibly variably trusted entities in your protocol. That's why there are still encryption and authentication layers above TLS. One simple example are apt repositories: It's desirable to be able to host deb packages on many servers, often controlled by semi-trustworthy parties, and still allow clients to authenticate them. It would be possible to use TLS alone for package download, but that would require handing over your authentication keys to every single mirror server. So arguably, Debian did "roll their own crypto" – but it was strictly for the better.