Re: Re: neuter the poodle

[mancha <mancha1 () zoho com>]

On Sat, Oct 18, 2014 at 09:01:55AM +0200, Nikos Mavrogiannopoulos wrote:
> Hi, The attack that you describe below is not an attack on tls
> negotiation. If you would be using the gnutls api as documented it
> wouldn't work. It is an attack on the insecure negotiation used by
> firefox, which as it seems it shares code with thunderbird. The text
> in my description is accurate, the attack affects mostly browsers, and
> if you are using the tls protocol negotiation you are safe.

Hi.

I don't think DKG was suggesting the GnuTLS API is vulnerable to
protocol downgrade attacks if used according to guidelines (I know I
wasn't).

His question relates to your "only browsers" comment, which as my attack
against Thunderbird+IMAPS shows, is inaccurate. My second link contains
a similar mistake by Red Hat.  

--mancha

Attachment: _bin
Description: