4 ms·

> without crippling their SSL/TLS configuration On that point: why is the previously allowed crypto settings now considered as good as nothing? I have to forc

> without crippling their SSL/TLS configuration On that point: why is the previously allowed crypto settings now considered as good as nothing? I have to force SECLEVEL=0 for openvpn/openssl to allow connecting to my company's vpn. From my reading that would allow any old cipher or hash rather than the previous minimum. Why is the previous level not kept as M and the library bumps the default to N? I know that a theoretical weakness means M is vulnerable to breaking but you force people to make it even worse. I think my boss hasn't updated his openvpn so he doesn't have new openssl so he never saw the problem. His company, his problem.

tialaramex 2y ago
People aren't anywhere close to sophisticated enough to make meaningful use of this more complicated functionality. What they're going to do if given this is call your hypothetical "SECLEVEL=M" feature secure and then be outraged when it isn't. If nobody is attacking you, no security will work fine. If you are being attacked, obsolete security likely won't help anyway.
- throwway120385 2y ago
  If you think of the ideal attacker as having a range of abilities and knowledge between "I found this tool on BitTorrent and am now going to try cracking your network from the outside with it" to "I spread my port scans out to multiple exit nodes over several days so you don't even notice me doing it" then having any security is better than nothing. All you have to do is make the sliver on the venn diagram of people who are trying to attack your system versus people who know how to attack your system as small as possible. It's not rocket science, and there are a lot of factors to balance here beyond the security level of a particular cipher.
- pixl97 2y ago
  I'm not sure if you've ever plugged into the internet, but there are constant probes occurring. They may not be an attack but simple information gathering that is used later (say someone finds a weakness in your configuration) and you and everything like you is attacked at once.
- Am4TIfIsER0ppos 2y ago
  I am forced to make my connection less secure than someone who hasn't updated. What's the logic behind that?

tialaramex 2y ago

People aren't anywhere close to sophisticated enough to make meaningful use of this more complicated functionality. What they're going to do if given this is call your hypothetical "SECLEVEL=M" feature secure and then be outraged when it isn't. If nobody is attacking you, no security will work fine. If you are being attacked, obsolete security likely won't help anyway.

throwway120385 2y ago
If you think of the ideal attacker as having a range of abilities and knowledge between "I found this tool on BitTorrent and am now going to try cracking your network from the outside with it" to "I spread my port scans out to multiple exit nodes over several days so you don't even notice me doing it" then having any security is better than nothing. All you have to do is make the sliver on the venn diagram of people who are trying to attack your system versus people who know how to attack your system as small as possible. It's not rocket science, and there are a lot of factors to balance here beyond the security level of a particular cipher.
pixl97 2y ago
I'm not sure if you've ever plugged into the internet, but there are constant probes occurring. They may not be an attack but simple information gathering that is used later (say someone finds a weakness in your configuration) and you and everything like you is attacked at once.
Am4TIfIsER0ppos 2y ago
I am forced to make my connection less secure than someone who hasn't updated. What's the logic behind that?