4 ms·
Https is to prevent wiretapping and man-in-the-middle attacks. The problem now is even you established HTTPS connection, the weak SHA-1 encryption will not pro
by xkiwi 12y ago
Https is to prevent wiretapping and man-in-the-middle attacks.
The problem now is even you established HTTPS connection, the weak SHA-1 encryption will not protect you.
- tptacek 12y agoThe SHA1 vulnerability being contemplated here affects only the establishment of an HTTPS connection; the attack scenario involves obtaining a forged certificate.
- rictic 12y agoThat's an especially pedantic correction, as it does not impact the meaning of the statement. s/the weak SHA-1 encryption/the weakened SHA-1 hash used to verify the certificate that's used to authenticate the encrypted connection/
- tptacek 12y agoIt is, you're right. It's a hobbyhorse of mine, though, because SHA1 (and MD5) appear in TLS ciphersuites as MAC components, and those uses are not known to be vulnerable at all.