Reputation
869
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
10 29
Impact
~52k people reached

  • 0 posts edited
  • 0 helpful flags
  • 86 votes cast
Feb
19
awarded  Notable Question
Feb
15
awarded  Popular Question
Feb
2
awarded  Notable Question
Dec
21
awarded  Popular Question
Dec
15
accepted Shared Global Blacklist Trust Issue
Dec
10
asked Shared Global Blacklist Trust Issue
Oct
29
accepted Public Key Certificate Pinning and MITM attack
Oct
29
comment Public Key Certificate Pinning and MITM attack
But that's just the thing that concerns me. In the example, they initiate a new connection in the DemoSSLRoot function (HttpClient client = new HttpClient();) and it will then fall out of scope when the function ends. When the app performs the "real" connection to start pulling down data, won't it be an entirely new connection, and won't the TLS handshake have to be renegotiated? Or perhaps you have to continue to use the same HTTPClient object?
Oct
29
asked Public Key Certificate Pinning and MITM attack
Oct
15
awarded  Popular Question
Oct
10
awarded  Popular Question
Sep
28
awarded  Notable Question
Jun
12
awarded  Yearling
Jun
9
accepted Is SQL Server 2016's Deterministic Encryption any good?
Jun
5
asked Is SQL Server 2016's Deterministic Encryption any good?
May
7
awarded  Notable Question
Apr
11
awarded  Popular Question
Mar
30
awarded  Popular Question
Mar
11
awarded  Popular Question
Feb
20
comment What security risks are posed by software vendors deploying SSL Intercepting proxies on user desktops (e.g. Superfish)
@BenVoigt Gotcha. So the Superfish debacle enables a clandestine active MITM attack, but not a passive attack nor offline decryption of captured traffic.