oss-sec mailing list archives
Re: On sanctioned MITMs
From: Eddie Chapman <eddie () ehuk net>
Date: Sat, 2 May 2015 11:27:35 +0100
On 02/05/15 00:39, mancha wrote:
Those are good suggestions for service providers seeking to outsource part of their processes but not so relevant to grandma e-banking or checking her medical results from her chalet in the Swiss Alps. As grannie is finding out, more and more sensitive transactions are being conducted over HTTPS these days. So, she's happy when she sees a lock in the url bar and gets no alerts from Firefox.
Despite whatever infrastructure and other real world challenges a company/organisation faces, what you write above is the most important issue. When we all see the lock in the URL bar, we expect and hope that the communications between our browser and the company/organisation is encrypted *all the way* to the company/org we identify in the URL.
This is a fundamental issue of trust which cannot be broken at all costs, even if it means more disruption to services. There is very little trust left out there and we cannot afford to erode it further, as this is more damaging than less service availability.
Apologies for continuing the off topic nature of this thread. Eddie
Current thread:
- On sanctioned MITMs mancha (May 01)
- Re: On sanctioned MITMs Hanno Böck (May 01)
- Re: On sanctioned MITMs Kurt Seifried (May 01)
- Re: On sanctioned MITMs Dean Pierce (May 01)
- Re: On sanctioned MITMs mancha (May 01)
- Re: On sanctioned MITMs Lyndon Nerenberg (May 01)
- Re: On sanctioned MITMs mancha (May 02)
- Re: On sanctioned MITMs Lyndon Nerenberg (May 02)
- Re: On sanctioned MITMs Joe Malcolm (May 04)
- Re: On sanctioned MITMs Eddie Chapman (May 02)
- Re: On sanctioned MITMs mancha (May 01)