[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CAAeBhPcExxcYUmgHX-SN=8agBKL=0t8utAx5qdAr-fSLW9wGZg@mail.gmail.com>
Date: Tue, 16 Feb 2016 23:07:10 -0500
From: David Leo <httpsonly.github.io@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Browser Security Tool: HTTPS Only (Why, How, Open
Source, Python)
Obviously you never read https://httpsonly.github.io/
1. The "Other Interesting Tools" section has tools to easily switch
proxy of your browser(FoxyProxy, etc). You want HTTPS-Only internet,
that's what this tool does; you want normal internet, just click that
FoxyProxy icon(yes, it's really easy).
2. The "What HTTPS Doesn’t Do" section has very clear words about
HTTPS limitations. Even though it's from US government, it's actually
very clear words.
Best Wishes,
On Mon, Feb 15, 2016 at 2:13 PM, <gremlin@...mlin.ru> wrote:
> On 2016-02-14 22:07:21 -0500, David Leo wrote:
>
> > This tool completely locks browser - just HTTPS, nothing else.
>
> That means, it causes effective DoS with "ssl_error_no_cypher_overlap"
> (as it's called by Firefox) for approx. 60% of all sites.
>
> In most cases, HTTPS is either misused or abused. But the ${subject}
> does both misuse and abuse: it forces HTTPS even for unauthenticated
> connections (are there any real reasons to use HTTPS instead of E2EE
> for protecting the information which is publicly available?), while
> not making any use of a clients' certificates.
>
> Ds: PoS
> Rp: >& /dev/null
>
>
> --
> Alexey V. Vissarionov aka Gremlin from Kremlin
> GPG: 8832FE9FA791F7968AC96E4E909DAC45EF3B1FA8
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
