3 ms·
> There are several unknown zero days in any application I think you want all your applications to authenticate the device and the user before proceeding to an
by rixed 11y ago
> There are several unknown zero days in any application
I think you want all your applications to authenticate the device and the user before proceeding to anything. This looks indeed impossible with third party closed source apps (if only because you can never be sure there is no backdoor).
Then, even if you authenticate every remote peers using TLS client certificates, you have to follow closely the vulnerabilities of your TLS implementation... But that should not be less manageable than to make sure your firewalls are reliable.
- istvan__ 11y agoI am not sure how the open source vs. closed source plays any role in this. You can support a feature with a closed source app as much as you can with an open source. TLS implementations having serious problems as the last few years proved it. We need a more fundamental change in security protocols and implementations, using reliable crypto (for example elliptic curve cryptography) and implementing them in safer languages (like Rust).
- icebraining 11y agoThis looks indeed impossible with third party closed source apps (if only because you can never be sure there is no backdoor). Seems easy enough: don't allow the app to bind to a port on any interface besides loopback, then put an authenticating reverse proxy in front of it that can actually receive remote connections. If it's an HTTP service, you can use nginx with client SSL certificates. For other protocols, spiped[1] might be a good choice. [1] https://www.tarsnap.com/spiped.html https://www.tarsnap.com/spiped.html