Re:Achieving a Perfect SSL Labs Score with Go
by darkhorn on Sunday May 22, 2016 @08:36AM
(#11748364)
Because it was developed for Google and they what they care is speed not security or client side certificates.
[ Parent
| on HN ]
Re:Achieving a Perfect SSL Labs Score with Go
by FiloSottile on Sunday May 22, 2016 @09:10AM
(#11748456)
This is so outlandish that I'd love to be able to dismiss you as a troll, but it's also so wrong it makes me angry, so I want to make sure no one nods reading your comment.
Google has SINGLEHANDEDLY improved the security of the TLS ecosystem by light-years:
* They ship the most modern client (Chrome), and started the auto-update trend.
* They forced the move from SHA1 and RC4 by leveraging that client power (with the degraded UI messages) even if it costed them popularity.
* They are leading CT, the single next best thing to happen to the ecosystem.
* They are keeping CAs accountable like no one did before.
* They have amazing people working on security UX and even shared the messages they use for anyone else to use.
* Finally, Chrome is by far the most secure browser you can use thanks to its state-of-the-art sandbox.
And take your client side certificates grudge somewhere else.