2 ms·
Yes, with the cooperation from CA the MITM is still possible. We however will provide server code to especially paranoid clients so they can build and run the
by vadiml 14y ago
Yes, with the cooperation from CA the MITM is still possible. We however will provide server code to especially paranoid clients so they can build and run the software on their own machines... This way they can have garanties against certificate tampering.
And we're working on an alternative solution when even cooperating CA will not allow MITM...
- StavrosK 14y agoThat sounds very good, good luck! Why not use ZRTP, though?
- vadiml 14y agoWell, this tech is derived from the project which was designed to meet specs of one of our clients. We did propose ZRTP during design phase, to the client but they security analysts decided against it. They affirm that given the state the current state of art in speech recognition and synthesis ZRTP can be vulnerable on impersonation during short code validation phase for the attacker with sufficient resources. I'm personally doubtful, but one thing i'm sure about, is that this client security experts have access to info and resources which are not available to me.
- StavrosK 14y agoThat sounds reasonable, thanks for the explanation.