Re:Signify: Securing OpenBSD from Us to You
by nickpsecurity on Friday June 12, 2015 @08:54PM
(#9709422)
My reading was they did the exact opposite: considered https to be a failure of end-to-end security they wanted. It was various users that apparently wanted HTTPS. I could see how they got to that: I access the site with HTTP; an intercept might happen; HTTPS protects HTTP; let's protect it with HTTPS! Fortunately, the experts knew better and avoided that nonsense.
[ Parent
| on HN ]
Re:Signify: Securing OpenBSD from Us to You
by what_the_diffie on Friday June 12, 2015 @11:08PM
(#9709732)
If end-to-end sec (e.g., crypto signatures) are used, like say with Debian packages which uses GPG, packages and metadata can be released over http without a problem.
Re:Signify: Securing OpenBSD from Us to You
by nickpsecurity on Friday June 12, 2015 @11:11PM
(#9709741)
Exactly. One of many reasons the developers went with an end-to-end solution instead of HTTPS. It makes the transport mechanism moot except for the initial key exchange.