Re: [TLS] Security today

[Rodney Thayer <rodney@xxxxxxxxxxxxxxxx>]

Mike wrote:

> P.S. and there's nothing you or I can do about it as a
> user -- we can't influence the key sizes or cipher suites
> offered by a server -- it's either take it or leave it.

(In a struggle to bring the thread back to tls-relevance...)

in theory you're supposed to look at the cert and it's cps
(which is referenced in a field in the cert in the payload
in the TLS protocol...) and the ciphersuite selection and
refuse to connect.

In other words, the protocol supports you deciding to
not interact with the server.

If your wireless service vendor uses 40 bit rc-4 and
an expired 1024 bit cert then one could reasonably
ask why you trust them ;-)

Since many of these TLS connections are being used
by trading partner users you CAN do something about it -
you can act like a trading partner and refrain from
doing business with people who run sloppy servers.
_______________________________________________
TLS mailing list
TLS@xxxxxxxx
https://www.ietf.org/mailman/listinfo/tls