Hacker News new | past | comments | ask | show | jobs | submit login

Forward secrecy is mostly a myth anyway when the “ephemeral” keys used to generate the session are kept in memory for weeks, months, or years already (e.g. HAProxy)



Sure, if you want to pretend that an easily-fixed bug makes security a myth.


It doesn't matter how easy the bug is to fix, if 90 out of 100 sites don't fix it. In this case it's less of a bug than it is a thorn, because rotating the keys requires knowing when they can actually expire, which requires state that the process holding the keys usually doesn't carry.

But my point was more along the lines that PFS was never a guaranteed contract with the client, only a possibility offered by certain key exchange protocols, and even then, easy enough to get wrong that most people did.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: