Re: HTTP is just fine

Hubert Kario <[email protected]> Wed, 25 Nov 2015 15:57:29 +0100

Newsgroups	gmane.comp.mozilla.security
Message-ID	<[email protected]>

On Wednesday 25 November 2015 15:40:07 Anne van Kesteren wrote:
> On Wed, Nov 25, 2015 at 2:52 PM, Hubert Kario <[email protected]> 
wrote:
> > On Wednesday 25 November 2015 12:31:48 Kevin Chadwick wrote:
> >> after all a compromise elsewhere could lead to a
> >> compromises of all https traffic on an end node anyway.
> > 
> > you really have no idea how TLS works and what it provides, now do
> > you?
> Could you please keep the discourse civil? As far as I can tell that
> statement is correct.
> If a client or server is compromised,
> connections to and from it are compromised too. Or simpler, if your
> computer is compromised, HTTPS is not going to protect you.

yes, TLS does not help against compromise of computer on either end of 
connection, so does using unecrypted communication, which makes this 
argument moot

in other words, if you imply that TLS does claim to protect you against 
the party you're connecting to, you have no idea about TLS provides
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic

_______________________________________________
dev-security mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security

signature.asc (application/pgp-signature, 819 B)