From owner-freebsd-security@freebsd.org Tue Dec 5 21:56:54 2017 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id B8EF2E843CA for ; Tue, 5 Dec 2017 21:56:54 +0000 (UTC) (envelope-from dewayne.geraghty@heuristicsystems.com.au) Received: from hermes.heuristicsystems.com.au (hermes.heuristicsystems.com.au [203.41.22.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "hermes.heuristicsystems.com.au", Issuer "Heuristic Systems Type 4 Host CA" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id EA4697442C for ; Tue, 5 Dec 2017 21:56:53 +0000 (UTC) (envelope-from dewayne.geraghty@heuristicsystems.com.au) Received: from [10.0.5.3] (ewsw01.hs [10.0.5.3]) (authenticated bits=0) by hermes.heuristicsystems.com.au (8.15.2/8.15.2) with ESMTPSA id vB5LuOna000848 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for ; Wed, 6 Dec 2017 08:56:24 +1100 (AEDT) (envelope-from dewayne.geraghty@heuristicsystems.com.au) X-Authentication-Warning: b3.hs: Host ewsw01.hs [10.0.5.3] claimed to be [10.0.5.3] Subject: Re: http subversion URLs should be discontinued in favor of https URLs To: freebsd-security@freebsd.org References: <97f76231-dace-10c4-cab2-08e5e0d792b5@rawbw.com> <5A2709F6.8030106@grosbein.net> <11532fe7-024d-ba14-0daf-b97282265ec6@rawbw.com> From: Dewayne Geraghty Message-ID: <8788fb0d-4ee9-968a-1e33-e3bd84ffb892@heuristicsystems.com.au> Date: Wed, 6 Dec 2017 08:55:00 +1100 User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 In-Reply-To: <11532fe7-024d-ba14-0daf-b97282265ec6@rawbw.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Content-Language: en-AU X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Dec 2017 21:56:54 -0000 On 6/12/2017 8:13 AM, Yuri wrote: > On 12/05/17 13:04, Eugene Grosbein wrote: >> It is illusion that https is more secure than unencrypted http in a >> sense of MITM >> just because of encryption, it is not. > > > It *is* more secure. In order to break it, you have to have > compromized https authorities. Some state actors have plausibly done > this. http, on the contrary, can be altered by anybody who has access > to the wire, which is generally a much wider set. > > > Yuri Yuri, It can be illusory.   My last job was as Sec Mgr for a large bank.  They disabled cert checking on client devices, placed a wildcard cert at the internet boundary and captured all https unencrypted.  An alternative approach to advocate is dnssec.  :) You also need to ensure integrity, to ensure that the numbers are flipped in transit...  ;)