News for hackers. Stuff that matters.

A comment on Security Update 2014-002. Parent comment

Re:Security Update 2014-002 by swordswinger12 on Tuesday April 22, 2014 @06:12PM (#7630819)
Doesn't this attack only apply to client authentication with renegotiation?
[ Parent | on HN ]
Re:Security Update 2014-002 by marklubi on Tuesday April 22, 2014 @06:16PM (#7630847)
From the write up at https://www.secure-resumption.com/, that appears to be a major limiting factor:

> We have confirmed that our attacks can be mounted on popular web browsers and HTTPS libraries, when they are used to perform certificate-based authentication at servers that enable both resumption and renegotiation.

[ Parent | on HN ]