3 ms·
Intrusive corporate firewalls MitM SSL sessions because the client is already compromised (IT installs the firewall's cert as a trusted CA). Any solution can't
by pyre 13y ago
Intrusive corporate firewalls MitM SSL sessions because the client is already compromised (IT installs the firewall's cert as a trusted CA). Any solution can't route around a situation where you don't trust the client machine.
- XorNot 13y agoRight but that's my point: it doesn't matter if it's encrypted. It matters if it's encrypted AND you've established trust. I'd go so far as to say that trust is actually more important - whether someone can read my messages is less important then verifying they're what the sender intended to send.
- grey-area 13y agoI agree it's really important, but we need both parts of the puzzle, not just one. Out of interest, what would your proposal for a new trust model for server communication be?
- XorNot 13y agoWeb-of-trust rather then CA-rooted, with more attention placed on who the signers are. i.e. if I'm using my bank, then what matters to me is whether the bank is certified by my government, not VeriSign or whoever. If it's a foreign bank, then it matters whether their government trusts them, and it matters to me whether MY government trusts them. If it's NOT a bank, then maybe my trust requirements are different. But the UI for all this and details are everything - but I think we've definitely stuck way too much import on that little green padlock icon without doing enough to educate users moment to moment about what it means.