where companies were sometimes willing to make real changes to earn an extra star.
> I think banks like the RSA key exchange because it allows them to deploy transparent TLS traffic decryption via private key sharing.
Oh yeah, that was something they complained about a lot with mandatory PFS in the TLSWG. :-(
Why do they need this for their consumer-facing sites, though? The theory over in the working group was about monitoring activities of bank employees on third-party web sites (I thought), rather than about monitoring activities of bank customers on the bank's own web site.
It's amazing how strong a motivation a grade or ranking can sometimes be. We saw this a lot with EFF's privacy practices report
https://www.eff.org/who-has-your-back-government-data-reques...
where companies were sometimes willing to make real changes to earn an extra star.
> I think banks like the RSA key exchange because it allows them to deploy transparent TLS traffic decryption via private key sharing.
Oh yeah, that was something they complained about a lot with mandatory PFS in the TLSWG. :-(
Why do they need this for their consumer-facing sites, though? The theory over in the working group was about monitoring activities of bank employees on third-party web sites (I thought), rather than about monitoring activities of bank customers on the bank's own web site.