3 ms·
The threat model changed. If I'm using HTTP, and my traffic is unencrypted, there isn't a vulnerability. If I'm using HTTPS, and my traffic is unencrypted or
by Wowfunhappy 3y ago
The threat model changed.
If I'm using HTTP, and my traffic is unencrypted, there isn't a vulnerability.
If I'm using HTTPS, and my traffic is unencrypted or can be decrypted, there's a serious vulnerability!
- hsbauauvhabzb 3y agoI would argue you’re almost right, the two considerations are intent (if you say something is true and it is not true, that is a vulnerability) and real world use (if the site accepts usernames and passwords, and is unencrypted, and there is some impact to a breach or credential theft, there is a vulnerability).
- 7e 3y agoThis CVE does not allow decryption (or non-encryption) of HTTPS.
- DANmode 3y agoThe point is the expectation not meeting reality - nothing about that specific technology.
- rekoil 3y agoJust strange to use HTTP for comparison when the actual problem works just fine. If I'm connecting to WiFi normally, and expecting that I can be tracked, there isn't a vulnerability. If I'm connecting to WiFi using this privacy feature, and expecting NOT to be trackable, yet someone is still able to track me, there is a serious vulnerability!
- fooker 3y agoThat's what comparisons and analogies are for. The HTTP comparison helped me understand the issue.
- rasz 3y agoPre 14 phones leak MAC to all people around, post 14 phones only expose it inside encrypted network phone was allowed to connect.