Time to Encrypt the Cloud

Re:Time to Encrypt the Cloud by ianopolous on Tuesday February 21, 2017 @03:37AM (#13694229)

It's not the browser sharing the hash content, but the javascript in the page. In something like this you clearly have to trust the javascript you download each time in the page.

[ Parent | on HN ]

Re:Time to Encrypt the Cloud by hashtagInsecure on Tuesday February 21, 2017 @03:49AM (#13694255)

https://www.schneier.com/blog/archives/2015/05/detecting_qua...

[ Parent | on HN ]

Re:Time to Encrypt the Cloud by ianopolous on Tuesday February 21, 2017 @04:01AM (#13694298)

Is that attack possible over https, without compromising a CA or a local hack like sslStrip? If a page is doing secret stuff over http it's even more broken.

[ Parent | on HN ]

Re:Time to Encrypt the Cloud by saycheese on Tuesday February 21, 2017 @07:33AM (#13694997)

>> "The usage of HTTPS in combination with HSTS can reduce the effectiveness of QI. Also using a content delivery network (CDN) that offers low latency can make it very difficult for the QI packet to win the race with the real server."

Above is from the researchers: https://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-in...

[ Parent | on HN ]

Re:Time to Encrypt the Cloud by ianopolous on Tuesday February 21, 2017 @09:57AM (#13695919)

It's not clear to me how it is possible over https only sites without forging a certificate or MITMing the connection. The new content would have to be encrypted with the correct key.

If indeed this is possible then the internet is totally broken. "Reduce the effectiveness" implies that it is still possible though.

[ Parent | on HN ]

Re:Time to Encrypt the Cloud by saycheese on Tuesday February 21, 2017 @10:28AM (#13696160)

Not sure it means the internet is broken, but would mean SSL is broken.

[ Parent | on HN ]