EFF's 2011 Holiday Wish List

https://www.eff.org/deeplinks/2011/12/effs-holiday-wish-list

by llambda • 15 years ago

36 11 15 years ago

drx• 15 years ago

Must be cool for Colin to have Tarsnap featured there (as secure backup provider Tarsnap puts it, "[b]ackups are supposed to be a tool for mitigating damage — not a potential vulnerability to worry about!")

marquis2• 15 years ago

Regarding "All software downloads should be provided only over HTTPS", this is very expensive to provide, but is allowing users to compare a checksum an equally secure option?

jpiasetz• 15 years ago

What's to stop someone in the middle changing the checksum on the page?

fuzzmeister• 15 years ago

The download page could still be served via HTTPS, even if the download itself isn't.

nodata• 15 years ago

The checksum is normally gpg signed.

MikeCapone• 15 years ago

By expensive you mean in CPU cycles, right? Isn't it becoming less expensive all the time thanks to Moore's Law? Is it really all that expensive these days? (I'm really asking because I don't know, this isn't rethorical.)

marquis2• 15 years ago

Yes, CPU cycles is the most expensive. Great discussion here on Stackoverflow:

http://stackoverflow.com/questions/149274/http-vs-https-perf...

alexchamberlain• 15 years ago

Could this be mitigated by using some form of hardware accelration on servers?

davorak• 15 years ago

Not a security expert here but it seem like akamai should also be required to use a root CA that does not use md5 for it's encryption. It am under the impression that md5 based encryption has been broken since 2008: http://www.win.tue.nl/hashclash/rogue-ca/#sec71

ordinary• 15 years ago

MD5 is not an encryption algorithm. It is a hashing algorithm. You're right though, it is broken.

Dylan16807• 15 years ago

The authentication is based on encrypting said hash, so I would say that md5-based is good enough as a description.

EFF's 2011 Holiday Wish List

Related Stories