Timeline for Can proprietary protocols be considered as secured?
Current License: CC BY-SA 4.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 11, 2021 at 15:44 | comment | added | Nosajimiki | @Shadur The only way to prove the security of any system is to test it in its actual implementation. It's like buying two doors. One you can watch the manufacturing process for, and the other you can't. Seeing how the one is made can tell you if it looks secure, but until you put both doors in their frames and try kicking them in, you really don't know which is better. Proprietary systems can be penetration tested just as easily as open source, and that tells you a heck of a lot more than reviewing someone's source code. | |
| Oct 9, 2021 at 23:18 | comment | added | Roman Odaisky | @GalacticCowboy Then your protocol is “hide the key under a mat” and the key is “which mat”. Once an attacker figures out the protocol, you are vulnerable until you change the entire protocol, simply revoking the old key and generating a new one isn’t enough. | |
| Oct 9, 2021 at 9:05 | comment | added | Shadur-don't-feed-the-AI | @DavidMulder The former is preferred, but if the latter is certified and well trusted it'll do in a pinch. | |
| Oct 9, 2021 at 7:17 | comment | added | David Mulder | @Shadur With 'disclosed' are you referring to public disclosure, or just to a team/company that can independently audit it? | |
| Oct 8, 2021 at 10:44 | comment | added | tim | @Kevin In that case, the security measure in question against eavesdropping is TLS or VPN. That's of course fine, and we don't need to care about what is transmitted to say that "data confidentiality in transit over the network" is protected. But in OPs case, using the proprietary protocol is the security measure itself. Now, this might be a miscommunication, but as presented, that is definitely not fine. | |
| Oct 8, 2021 at 1:17 | comment | added | Allison | @Keven Good example of this is Signal's backend. We know they can't snoop just from the client app since the cryptography is provably secure. We don't need to know anything about the backend, hell, it could by going right to all the three letter agencies for all it matters! | |
| Oct 7, 2021 at 20:58 | comment | added | Kevin | @Shadur: I'm not sure I agree with that. If you know that the protocol is secured by a (properly-implemented and deployed) TLS or VPN tunnel, then the specific contents of the plaintext are (or should be) irrelevant. So you don't need to open the whole protocol, just the parts that are actually responsible for security. | |
| Oct 7, 2021 at 20:25 | comment | added | GalacticCowboy | I hide my key under my neighbor's mat. | |
| Oct 7, 2021 at 16:53 | comment | added | Shadur-don't-feed-the-AI | Pertinent to the question, a "proprietary" security measure can not be proven secure until and unless it's disclosed so it can be assessed, and must therefore be considered insecure until such time. | |
| Oct 7, 2021 at 7:28 | history | answered | schroeder♦ | CC BY-SA 4.0 |