"The more you tighten your grip, the more systems will slip through your fingers." -- Princess Leia | [reply] |
If using the "more secure" technology results in more "Entities" intercepting and bumping SSL traffic, then security has been lowered. I'm not saying "how much" it is lowered. It's like open-source If you have specific needs or wants, you are welcome to submit your own work. Your attitude feels a bit demanding -- because you don't like that more people are routinely breaking open SSL streams, you want figures on how much. I'd like to see those too -- so if you want to find out and share the information with us, that'd be great!
In addition to the uptick in those asking how to do SSL bumping (start w/squid-users list and its archives and view the number asking for how to do it, or look at the squid-cache wiki and see the info on how to set it up and note that it wasn't available 10 years ago. People wouldn't take the time to publish how-to's in a wiki if there was no demand. Five-ten years ago, most of the questions were about how to cache various types of content or block it. Now a fair percentage is related to SSL bumping. If you want exact percentages, you are welcome to peruse the archives or google search for those making mistakes with certs.
Dell, for example, installed a root-cert with the private key on all Dell computers that is reinstalled via their update service (https://www.grc.com/sn/sn-535-notes.pdf). Other discussions are going on about whether or not USA certs are trustworthy with the CIA, apparently being caught with more than one suborned root-cert (https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/istISpHpMqE). I've seen articles that talk about companies (including some ISP's) purchasing suborned root-certs for their network/customers.
Since https has become more common, more entities have decided to find ways to intercept and crack that traffic. If you want details as to amounts, you are welcome to contribute... You should feel lucky -- it's not like it is a closed-project where you can't contribute.
| [reply] |
I find the assertion that the more https traffic goes through the web, the less secure the web is to be in the same realm as “the Earth is flat.” It’s an outrageous assertion from my perspective and requires evidence, not conjecture, or it should be dismissed outright. Consider a corollary to your assertion: If all https traffic were switched to http, the web would be more secure.
| [reply] |
