such features should generally be considered dangerous. Noone tests it, noone looks at it, until someone does and finds it's all broken and not doing what it's supposed to do. We had this before (Heartbleed...).
Prikaži ovu nit
The windows vuln is ultimately a flaw of excessive flexibility and excessive algorithm agility. The flaw is a "feature" of TLS where you can define a custom elliptic curve. Noone does that in practice.
-
-
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
Gotta love TLS features https://mailarchive.ietf.org/arch/attach/tls/txtBOpyxc.txt …
-
I don't get why do we need a new RFC when OpenSSL has implemented this feature a dozen times already.
- Još 1 odgovor
Novi razgovor -
-
-
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
Surely not TLS - Basic path validation? So are you saying the standards are broken? I think the implementation isn't implementing them correctly. Also ever tried stuffing brain pool curves into a crypto library that doesn't support them...
-
the implementation is broken, but that doesn't let the standard off the hook. If you create standards with plenty of pitfalls and no use case you will get broken implementations.
Kraj razgovora
Novi razgovor -
-
-
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.