Re: Is SSL/TSL really secure?

From: Volker Birk <bumens@xxxxxxxxxxx>
Date: 28 Mar 2006 18:06:19 +0200

Ludovic Joly <lgr_joly@xxxxxxxxx> wrote:

SSL/TLS is subject to man-in-the middle attacks.

Of course, one has to check certificates.
And a web of trust is the better concept.

Yours,
VB.
--
At first there was the word. And the word was Content-type: text/plain
.

Follow-Ups:
- Re: Is SSL/TSL really secure?
  - From: Ludovic Joly

References:
- Is SSL/TSL really secure?
  - From: tomodachigai
- Re: Is SSL/TSL really secure?
  - From: Volker Birk
- Re: Is SSL/TSL really secure?
  - From: Ludovic Joly

Prev by Date: Re: Is SSL/TSL really secure?
Next by Date: Re: Is SSL/TSL really secure?
Previous by thread: Re: Is SSL/TSL really secure?
Next by thread: Re: Is SSL/TSL really secure?
Index(es):
- Date
- Thread

Relevant Pages

Proofs, burdens, abrahamic claims, and out-of-band data
... When you get a trust point certificates so you can tell if the site ... method that does not directly involve in-band transmission. ... The usual way to do out-of-band is to have the manufacturer of your ...
(soc.religion.mormon)
Re: New Method for Authenticated Public Key Exchange without Digital Certificates
... > certificates were redundant and superfluous when the relying party ... > context of the original posting) and the semantic meaning of trust ... > the addition of public key operations to these environments isn't to ... > operations are the financial institutions. ...
(sci.crypt)
Re: Proposal for a new PKI model (At least I hope its new)
... >>If we should trust these certificates, ... (Just as we should do for existing certificates issued by ... > level certificate to a small organization's PKI server in australia ... HTTPS is precisely so I don't need to trust DNS: ...
(sci.crypt)
Re: Enterprise Subordinate CA signed by third party Commercial CA like Verisign/Thawte/etc
... we will need to have trust ... As far as standard versus enterprise, ... If the root CA is compromised your whole PKI ... > your certificates then it would make sense to use your own CA. ...
(microsoft.public.windows.server.security)
Re: New Method for Authenticated Public Key Exchange without Digital Certificates
... What would then 'two machines trust each other' above ... General purpose workstations have such poor control over CA certificates ... >> Possibly, but in practice, rarely where there is substanitve risk to the ... for PKI to produce the mythical trust it is supposed to have. ...
(sci.crypt)