Re: breaking TLS (Was: Re: multiplexing -- don't do it)

[Amos Jeffries <[e-mail]>]

On 7/04/2012 4:02 a.m., William Chan (陈智昌) wrote:
> I don't like this analogy. Humans have basic immune defenses. In most 
> places, we put locks on public facing doors. We send mail in sealed 
> envelopes. Yet we send almost all our browsing traffic in the clear. 
> Come on guys.
>
> And it's not like there aren't enough organizations out there trying 
> to break SSL already. I think they're already pretty motivated.

I think its a great analogy. Door locks are themselves a bygone security 
technology that was top of the line once and got broadly deployed, even 
there its still "most places" with patchy lock coverage in "legacy" 
country areas and postcards. The result, lock picks as sophisticated as 
rammers.

No use trying a lock pick against a bank safe though, or using an RFID 
scanner against a country hick with barred windows. Variation and 
appropriate application is the backbone of real security. We just need 
to keep that in mind when thinking of rolling TLS into everywhere.

AYJ