Re:Challenge HN: Break my in-browser crypto for $1000
by lawnchair_larry on Thursday May 30, 2013 @08:07PM
(#5796052)
But it's not a given that you can "break" SSL. The problem that moxie is highlighting actually has no solution (even HSTS isn't a solution) and relies on users to not notice that they have been downgraded to HTTP.
Unless moxie also wants to say, with a straight face, that twitter and gmail would be better off disabling HTTPS, I don't think that claim is fair.
Respectfully, I'd suggest that this is not the argument.
The argument is that breaking SSL = accessing the data the crypto protects. Crypto is a means to an end...which is protecting sensitive information. moxie decidedly did not "break" the crypto, because he didn't have to.
It's a bit like a bank vault with the world's strongest door, but when it was installed they put in a 4' x 5' window next to the door. The vault door (aka the crypto) is fine and unbroken, but I still can get access to your money because your security system has a weak point.