Channels
#general
- l
LucaCastelnuovo
07/14/2020, 1:00 PMwhat does that mean? - u
user
07/14/2020, 1:00 PMYou are trying to protect against TLS MITM, right? - l
LucaCastelnuovo
07/14/2020, 1:01 PMWell was, but I have given up on that - l
LucaCastelnuovo
07/14/2020, 1:02 PMNow I'm just trying to limit damage if server logs are leaked, and trying to protect as much little things as possible - l
LucaCastelnuovo
07/14/2020, 1:02 PMOf course I want to solve every angle of attack, but I just can't find a way to protect aginst MITM - u
user
07/14/2020, 1:02 PMIf you want to limit damage there, I think what you said above is most relevant, never log credentials anywhere - l
LucaCastelnuovo
07/14/2020, 1:03 PMThe good old times: I got an email from GitHub, "Hi our bad, yes we saved your password in plain text logs :D" - u
user
07/14/2020, 1:03 PMin order to protect against that you need a key exchange that happens outside the vulnerable process. This is how cryptocurrencies do it - l
LucaCastelnuovo
07/14/2020, 1:04 PMSo the TLS happens over like mobile connection? - l
LucaCastelnuovo
07/14/2020, 1:04 PMIs MITM possible on mobile (excluding the ISP)? - u
user
07/14/2020, 1:05 PMmobile or not, if there is a proxy with a valid cert which is for your domain, you are hosed - l
LucaCastelnuovo
07/14/2020, 1:05 PMIs MITM also likely* on onion sites? - u
user
07/14/2020, 1:06 PMit's just tor, and tor has weaknesses as well, signature just is an orthogonal problem - u
user
07/14/2020, 1:06 PMTor is about masking, not about signage - l
LucaCastelnuovo
07/14/2020, 1:07 PMOkay, how could you move the signing process like with cryptocurrencies? - u
user
07/14/2020, 1:09 PMso with cryptocurrencies, they protect against tampering, not sure that is the problem you are trying to solve, or is it? The data is public, but it is signed. Or do you care about the information being private too? - l
LucaCastelnuovo
07/14/2020, 1:10 PMUhm, as private as possible - l
LucaCastelnuovo
07/14/2020, 1:11 PMBut some mechanisms to validate it isn't tampered with would be a bonus - u
user
07/14/2020, 1:11 PMprivate does ensure tampering, it's just stronger and therefore more difficult - u
user
07/14/2020, 1:11 PMto handle private, you need mutual TLS, which means credential exchange and that has to happen on a "safe" device - l
LucaCastelnuovo
07/14/2020, 1:12 PMA safe client device?, and an safe server device? - u
user
07/14/2020, 1:13 PMunless you are writing both pieces, in general, just worry about your side, assuming the server offers mTLS - l
LucaCastelnuovo
07/14/2020, 1:14 PMI'm writing the frontend and backend code, is that what you mean? - u
user
07/14/2020, 1:14 PMyeah - u
user
07/14/2020, 1:14 PMlook into mTLS - u
user
07/14/2020, 1:14 PMthat would be my first suggestion - l
LucaCastelnuovo
07/14/2020, 1:15 PM"mTLS is just an extension of TLS (Transport Layer Security). This is commonly found in verifying endpoints and for encrypting communications and for TLS specifically, browsers. The ‘HTTPS’ in a URL is the evidence for this." Does this mean if I have
I haveHTTPSmTLS - u
user
07/14/2020, 1:16 PMno, that's TLS one direction, mTLS is TLS both directions - l
LucaCastelnuovo
07/14/2020, 1:16 PMThis is my oneway setup currently for all subdomains: https://www.ssllabs.com/ssltest/analyze.html?d=test.lucacastelnuovo.nl - l
LucaCastelnuovo
07/14/2020, 1:17 PMOh like this https://smallstep.com/hello-mtls/doc/client/axios