Re:Nginx doesn't suck at SSL after all
by tptacek on Wednesday July 13, 2011 @01:26PM
(#2759708)
Are you sure the problem is entropy generation and not just extra bignum math? Also: there are plenty of major financial apps that are not allowed to use DHE, because DHE makes it impossible for the provider to monitor its own connections ("conventional" SSL/TLS allows for middleboxes that monitor and archive sessions by holding a copy of the server's RSA key).
[ Parent
| on HN ]
Re:Nginx doesn't suck at SSL after all
by burgerbrain on Wednesday July 13, 2011 @01:32PM
(#2759740)
What is best for security in regulated fields and what is mandated or forbidden for security in regulated fields are often almost disjoint sets.
Anyway, whether your phone has trouble coming up with the entropy, or preforming the math, you should probably be using something more substantial.
You're suggesting that people should pick a different phone so they can get PFS with the small fraction of SSL servers that support it?
Re:Nginx doesn't suck at SSL after all
by burgerbrain on Wednesday July 13, 2011 @01:38PM
(#2759766)
I'm suggesting that if for some reason a site thinks that that sort of security is necessary, they shouldn't change their mind for the sake of people using their telephones.
Particularly since at the current rate of development, the average phone will be able to do it just fine in a few months.