3 ms·
Forward secrecy was one of the important mistakes I had in mind actually. If you use TLS naively, you have none. You probably didn't even realize you needed i
by brl 18y ago
Forward secrecy was one of the important mistakes I had in mind actually. If you use TLS naively, you have none. You probably didn't even realize you needed it.
Verifying certificates correctly is not so easy to get right either, if you can even figure out what PKI means for your particular application in the first place.
- tptacek 18y agoCertificates are a lot like git branching. They're intimidating if you consider them in their entirety, but simple if you stick to your old use cases. Enterprise apps make good use of certificates. A common use case is to set up a private CA (a three-line shell script) and issue internal certs to all endpoints in a system; you can then do crypto-strong access control just by checking signatures. This is approximately to PKI what "using git just like you used Subversion" is to git. Another place where TLS has been a huge win is in wireless security; EAP-TLS with mutual certificate auth is the de facto corporate wireless security standard now.