News for hackers. Stuff that matters.

A comment on Netflix now supports TLS 1.3. Parent comment

Re:Netflix now supports TLS 1.3 by rechristened on Tuesday April 21, 2020 @03:07PM (#22938251)
How are you distributing the hashes?
[ Parent | on HN ]
Re:Netflix now supports TLS 1.3 by MaxBarraclough on Wednesday April 22, 2020 @01:23PM (#22947960)
Either over HTTPS or by signing the manifest files using a well-known public key, and ensuring that stale manifests are never used (otherwise it's possible for an attacker to cause installation of old, vulnerable software).

apt used to be 100% HTTP based. I believe they've changed course recently though. Unsure about Steam.

Steam were clear that the reason they adopted insecure HTTP (previously they used a proprietary protocol) was to enable web caching, by ISPs and other organisations. I can imagine that being very beneficial at a commercial LAN party, for instance.

Related reading: https://wiki.debian.org/SecureApt

[ Parent | on HN ]
Re:Netflix now supports TLS 1.3 by ric2b on Tuesday April 21, 2020 @07:29PM (#22940410)
Not that I'm agreeing that they don't need HTTP, but they could do a HTTPS connection to fetch the (relatively small) hashes. On the native applications they could bundle their public key and do everything via HTTP, signing the hashes.
[ Parent | on HN ]