4 ms·
That's not true. QUIC's encrypted traffic does not protect against MITM.
by nabla9 1y ago
That's not true. QUIC's encrypted traffic does not protect against MITM.
- viraptor 1y agoQUIC uses TLS1.2 (or higher), so the guarantees are the same as for HTTPS streams. That means it protects the data streams against MitM.
- lazide 1y agoNot if they have a root cert.
- Thorrez 1y agoIf China uses a root cert to issue bogus certs, that'll get caught by certificate transparency. Assuming people use browsers that enforce certificate transparency.
- eptcyka 1y agoKazakhstan literally forced their own cert for lots of popular sites for a while, expecting users to click the through and accept them. It was made illegal to not accept government certificates.
- esafak 1y agohttps://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_attack https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_a...
- Thorrez 1y agoWas Kazakhstan successful? esafak's link seems to imply it wasn't very successful. Anyways, my point wasn't that a government can't MITM using a root cert. My point is that the government can't do so secretly. The whole world will know if they try.
- viraptor 1y agoThat's not a property of QUIC. Yes, if you trust both sides, then you trust both sides. That's not what people normally understand as MitM.
- lazide 1y agoPre-cert usage/issuance lists, it would take a keen eye to spot auto-mitm using root certs.
- nabla9 1y agoNot any different from TLS.1.2 over TCP. https://en.wikipedia.org/wiki/File:HTTP-1.1_vs._HTTP-2_vs._HTTP-3_Protocol_Stack.svg https://en.wikipedia.org/wiki/File:HTTP-1.1_vs._HTTP-2_vs._H... Here is good intro for you: The Security Challenges of HTTP/3 and QUIC — What You Need to Know https://medium.com/@RocketMeUpCybersecurity/the-security-challenges-of-http-3-and-quic-what-you-need-to-know-7c1996cbc502 https://medium.com/@RocketMeUpCybersecurity/the-security-cha...