Timeline for Why is STARTTLS used when it can be downgraded very easily?
Current License: CC BY-SA 4.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 24, 2019 at 17:55 | comment | added | AndreKR | @Luc Yes, that works too, changed it. What I actually meant is more like "Why is STARTTLS used and SSLv3 is not when both can be made insecure by downgrading?" | |
| Sep 24, 2019 at 17:55 | history | edited | AndreKR | CC BY-SA 4.0 |
edited title
|
| Sep 24, 2019 at 7:33 | comment | added | Luc | I think the title could be improved to something like: "Why is STARTTLS used when it can be downgraded very easily?" What do you think, AndreKR, does that still reflect your question correctly? The current title sounds like starttls is outdated or deprecated and even had me confused for a minute. | |
| Sep 24, 2019 at 1:57 | comment | added | Joshua | Incidentally, the server speaking SSLv3 is not the primary issue. I've heard reasonable reports the downgrade can still happen if the client supports SSLv3 even if the server doesn't. In any case, if the client refuses to support SSLv3 the attack simply can't happen. | |
| Sep 22, 2019 at 16:06 | answer | added | user | timeline score: 14 | |
| Sep 22, 2019 at 15:00 | history | tweeted | twitter.com/StackSecurity/status/1175786927238332423 | ||
| Sep 22, 2019 at 14:11 | history | became hot network question | |||
| Sep 22, 2019 at 7:53 | answer | added | Steffen Ullrich | timeline score: 50 | |
| Sep 22, 2019 at 6:01 | history | asked | AndreKR | CC BY-SA 4.0 |