Re:HTTPS Watch
by sanxiyn on Monday January 19, 2015 @04:43AM
(#8911167)
The argument is that someone may not be able to audit TLS stack, not that someone may not be able to use TLS stack.
Requiring TLS forces people to include TLS stack, which enlarges trusted computing base a lot. Security depends on many things, but the size of trusted computing base is an important factor.
Requiring TLS forces people to include TLS stack, which enlarges trusted computing base a lot. Security depends on many things, but the size of trusted computing base is an important factor.