Tag Info

New answers tagged

0

I ended up asking on the OTR's developer mailing list and here's the response I got: On Wed, Apr 08, 2015 at 02:51:14PM +0200, Jacek Wielemborek wrote: Hello, Here's something that keeps bugging me for a moment. It's a hypothetical situation, so please refrain from question like "how did you send the FP to your friend?". ...


1

I think you need to separate in your mind confidentiality protection from authentication. It is quite possible to simultaneous generate a key between two parties over the Internet, with everyone from your ISP to every Govt possible listening in, yet they cannot as an eavesdropper also generate that key. That is the essential point of say the ...


0

Yes, but you need some way to be sure that a public key of the recipient corresponds to the person you want to talk to. When you rely on a central service to find a public key for a name/email address/phone number, you're vulnerable to MITM by the "directory service". To get a public key for a person using the internet you can use PKI (and then you're ...


0

Instead of using a hardcoded key, you should use mutual SSL authentication. Using an obfuscated key, doesn't add any security, certainly not when you're already using SSL.


2

There is already an infrastructure to manage trust and it's called "Public Key Infrastructure". This is the basis of all the SSL/TLS protocols used over the internet and websites. The main idea is to designate a Trusted Third Party (TTP) which is recognised by all the parties involved. These TTP issues their public key and they are shipped by default in ...


1

Looks good to me. Note that, depending on the cipher list you enable, HTTPS will do a DH key exchange. As long as you trust the SSL implementation on the device and the server, and that you audit the certificate trust list on the device, the connection between the device can be considered secure. The only thing I'm concerned about is that the device can ...



Top 50 recent answers are included