Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> 4) Serve the whole lot over TLS.

But your server is configured to allow SSLv3[0]

[0] https://www.ssllabs.com/ssltest/analyze.html?d=fix%2dmacosx....



If you're referring to the POODLE SSLv3 bug, it doesn't break authentication/key exchange or MAC, but instead, confidentiality of the symmetric encryption.

In other words (assuming an attacker can modify a sufficient amount of SSL traffic in transit), they could decrypt the python source code, but they can't insert new data without triggering a MAC validation failure on the client.

https://www.openssl.org/~bodo/ssl-poodle.pdf




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: