W3C home > Mailing lists > Public > ietf-http-wg@w3.org > July to September 2014

RE: HTTP/2 and Pervasive Monitoring

From: Albert Lunde <atlunde@panix.com>
Date: Fri, 15 Aug 2014 08:08:08 -0500
To: <ietf-http-wg@w3.org>
Message-ID: <01c101cfb889$f7814bf0$e683e3d0$@panix.com>

>What you can do in an MITM scenario isn't really relevant to PM. It's still harder to MITM weak TLS than clear text.
>
>I think it is more worrisome having the weak ciphers in there at all, as it opens up for bad configurations and downgrade attacks of https connections.

Outside the realm of standards, the print edition of "Bulletproof SSL and TLS: Understanding and Deploying SSL/TLS and PKI to Secure Servers and Web Applications" by Ivan Ristic just shipped(as in I expect to get a copy from Amazon later today) The chapter on OpenSSL has been available for a while, and helped me with some recent issues.
Received on Friday, 15 August 2014 13:08:29 UTC

This archive was generated by hypermail 2.3.1 : Wednesday, 30 March 2016 09:57:10 UTC