Re: FYI: TLS Triple Handshake Attack

On 3/3/14 5:08 PM, Melvin Carvalho wrote:
> https://www.imperialviolet.org/2014/03/03/triplehandshake.html
Yes, note "In short, the TLS handshake hashes in too little information, 
and always has. Because of that it's possible to synchronise the state 
of two TLS sessions in a way that breaks assumptions made in the rest of 
the protocol."

Well, those assumptions will always be brittle if a TLS handshake is the 
be all and end all. Once again, this is why WebID, WebID+TLS, and Trust 
Logic are a much better solution for this problem.

Our challenge remains:

1. getting the WebID spec out
2. showcasing how it addresses these problems via RDF based Linked Data 
augmentation
3. cognitive dissonance that swirls around anything to do with RDF and 
the Semantic Web vision.

-- 

Regards,

Kingsley Idehen 
Founder & CEO
OpenLink Software
Company Web: http://www.openlinksw.com
Personal Weblog: http://www.openlinksw.com/blog/~kidehen
Twitter Profile: https://twitter.com/kidehen
Google+ Profile: https://plus.google.com/+KingsleyIdehen/about
LinkedIn Profile: http://www.linkedin.com/in/kidehen