3 ms·

> Perhaps he should have said "Using SSL is like using antibiotics. If everyone is using it all the time, the attackers just find ways around it that are imposs

> Perhaps he should have said "Using SSL is like using antibiotics. If everyone is using it all the time, the attackers just find ways around it that are impossible to defend against and you're screwed." Except no such mechanism exists. If you build proper crypto, it's secure, attackers can not simply make it insecure by wishing it were. > Also, I'm no SSL expert, but even if the certificate is expired and the user acknowledges the error, isn't the communication still encrypted? But it might be using a compromised key, for example. Also, one problem is people getting used to clicking "OK" on SSL warnings, which might backfire when confronted with an actual attack.

unreal37 12y ago
> Except no such mechanism exists. If you build proper crypto, it's secure, attackers can not simply make it insecure by wishing it were. It's like the XKCD cartoon.[1] The best crypto can be defeated by a wrench and a guy willing to hit you with it. Or more likely, by passing laws requiring all the major companies of the world to give the government access to the servers whenever they wish. Or by building backdoors into routers that allow them into networks. The way to defeat good crypto is to go around it. [1] https://xkcd.com/538/ https://xkcd.com/538/