5 ms·

An interesting read. Perhaps he should have said "Using SSL is like using antibiotics. If everyone is using it all the time, the attackers just find ways aroun

An interesting read. Perhaps he should have said "Using SSL is like using antibiotics. If everyone is using it all the time, the attackers just find ways around it that are impossible to defend against and you're screwed." Not sure I get the analogy about having gates on the subway are bad when people need to use the subway in an emergency. Like, if you have a stab wound and are taking the subway to the hospital, its better not to have to fumble around for change in your pocket and line up for a ticket? Seems like there are actually very few or no emergencies where someone needs to ride the subway for free. Also, I'm no SSL expert, but even if the certificate is expired and the user acknowledges the error, isn't the communication still encrypted? They don't lose the encryption just because of an expired certificate do they? I honestly don't know, but I just assumed that's how it worked. The one thing I agree with is that the trust model for SSL is opaque to most users. I have no idea who my browsers trust by default, and I have no idea who those guys trust, and even if there is a 3rd degree of trust beyond that, and so ultimately there are thousands of people around the world who could spin up an SSL certificate that my browser would trust without question. Strange system.

zAy0LfpBZLC8mAC 12y ago
> Perhaps he should have said "Using SSL is like using antibiotics. If everyone is using it all the time, the attackers just find ways around it that are impossible to defend against and you're screwed." Except no such mechanism exists. If you build proper crypto, it's secure, attackers can not simply make it insecure by wishing it were. > Also, I'm no SSL expert, but even if the certificate is expired and the user acknowledges the error, isn't the communication still encrypted? But it might be using a compromised key, for example. Also, one problem is people getting used to clicking "OK" on SSL warnings, which might backfire when confronted with an actual attack.
- unreal37 12y ago
  > Except no such mechanism exists. If you build proper crypto, it's secure, attackers can not simply make it insecure by wishing it were. It's like the XKCD cartoon.[1] The best crypto can be defeated by a wrench and a guy willing to hit you with it. Or more likely, by passing laws requiring all the major companies of the world to give the government access to the servers whenever they wish. Or by building backdoors into routers that allow them into networks. The way to defeat good crypto is to go around it. [1] https://xkcd.com/538/ https://xkcd.com/538/
Lawtonfogle 12y ago
>Perhaps he should have said "Using SSL is like using antibiotics. If everyone is using it all the time, the attackers just find ways around it that are impossible to defend against and you're screwed." Except we are dealing with intelligent actors instead of unguided evolution. They will go after those tools as long as anyone could possibly use SSL.

zAy0LfpBZLC8mAC 12y ago

> Perhaps he should have said "Using SSL is like using antibiotics. If everyone is using it all the time, the attackers just find ways around it that are impossible to defend against and you're screwed." Except no such mechanism exists. If you build proper crypto, it's secure, attackers can not simply make it insecure by wishing it were. > Also, I'm no SSL expert, but even if the certificate is expired and the user acknowledges the error, isn't the communication still encrypted? But it might be using a compromised key, for example. Also, one problem is people getting used to clicking "OK" on SSL warnings, which might backfire when confronted with an actual attack.

unreal37 12y ago
> Except no such mechanism exists. If you build proper crypto, it's secure, attackers can not simply make it insecure by wishing it were. It's like the XKCD cartoon.[1] The best crypto can be defeated by a wrench and a guy willing to hit you with it. Or more likely, by passing laws requiring all the major companies of the world to give the government access to the servers whenever they wish. Or by building backdoors into routers that allow them into networks. The way to defeat good crypto is to go around it. [1] https://xkcd.com/538/ https://xkcd.com/538/

Lawtonfogle 12y ago

>Perhaps he should have said "Using SSL is like using antibiotics. If everyone is using it all the time, the attackers just find ways around it that are impossible to defend against and you're screwed." Except we are dealing with intelligent actors instead of unguided evolution. They will go after those tools as long as anyone could possibly use SSL.