Another HTTPS Vulnerability Rattles The Internet

[Thpn]

It's ironic when institution which is supposed to protect your rights breaks them with impunity. Who is supposed to protect your from your protector?

That's the function of the courts!

[Luke]

For online encryption you cannot trust ssl and https as anything more than one of many layers in your security. They can stop your ISP from monitoring your traffic, but not if the NSA ordered them to watch your account. In that case https becomes good mostly for stopping things like Verizon's tracking headers. Use it anyway, the NSA is "court-shy" but if you need to protect an email from the government it's end to end GPG encryption you need. After all, they don't need to crack https to read the plaintext at a corporate email server. On the other hand, getting past https just to see encrypted packets going to a Tor guard node, then defeating Tor's encryption only to find yourself looking at GPG encrypted ciphertext is quite another matter! From my perspective, both the US government and the big corporations that control it are considered enemies along with their laws. That means I must be responsible for my own security. This begins with picking the low hanging fruit like using https on any and all sites that support it. Next up, known data loggers like Google and facebook are never accessed at all except through Tor, not used for search even through Tor, and no accounts ever made there. If something needs to be deniable, it goes through both Tor and https, two layers of security with the connection net encrypted by Tor being at the far end between the exit node and the website. That connection still gets one layer of weaker security through Tor. If deniablity in a courtroom is an issue, then it's time for a public wifi connection you do not normally use, combined with the above. I don't trust any one security measure absolutely, which is why I run browsers in RAM even when the whole disk is encrypted. Crack my disk, still can't get a browser history and cache. OK, you are not an activist, and you did not take my advice never to bank online. Maybe you don't bank online, but you used a credit card at the corner store. Guess what? That POS terminal at the cash register is using the Internet to talk to the bank! The same attack the NSA can do can be done by a thief with a good botnet, especially if the bot-herder can get some gaming computers into the botnet and say, reduce their fps by 10% and harvest the rest of a few thousand GPUs for cracking the export cipher. He could harvest credit card numbers for weeks on end and auction them all to the highest bidder. The defense against this attack would be for the banks to have a unique GPG key pair for every POS terminal and for every online banking customer. Now that bot herder would have trade in his botnet for a quantum computer-if they ever become large enough to be useful at all. Estimates for this are 5 to twenty years. In all these cases, if you let the law limit your ability to protect other people, you become the moral equivalent of a snitch.

[GraysonPeddie]

Not that I'm part of the TL;DR (too long; didn't read) crowd, but please break out your huge unreadable paragraph!!!

[gigaplex]

Meanwhile, in Australia...

[jimmylie]

nice information
thanks all