4 ms·
This seems overly complex assuming you are trying to prove something when you control both aspects of the process, or are engaged with the party that does. It
by tristor 2y ago
This seems overly complex assuming you are trying to prove something when you control both aspects of the process, or are engaged with the party that does. It should be trivial to use backend records or a significantly less complex client side implementation that just verifies what the user saw/did via standard RUM tracing methods, without relying on a custom TLS implementation.
Additionally, some of the statements about the "public" values in HTTPS are false in this document, that combined with relying on their custom TLS implementation deeply concerns me from a security perspective. I'm being hard pressed to imagine a situation where I would pick "write my own TLS implementation to subtly modify the protocol" as the answer.