News for hackers. Stuff that matters.
Re:The hidden cost of QUIC and TOU (2016) by rocqua on Friday November 02, 2018 @11:27AM (#18363690)
Dumping out those session keys comes with major logistical and security problems. All of a sudden, debugging requires

1) Updates on every client you might want to debug

2) Securely transporting the session keys from those clients to the person debugging.

Those are some massive challenges. An alternative is to always MitM all your devices. This comes with obvious downsides. Moreover, I could see providers doing cert-pinning that isn't over-ridden by user installed certificates. That would make it literally impossible to MitM your own devices.

This kind of cert-pinning really scares me, because it takes away any possibility to inspect your own network communications.

There are no comments on this comment yet.