TLS Security Limitations
Discussions center on the limitations of TLS/SSL encryption, including traffic interception by intermediaries, visibility of metadata and handshakes, and attacks like BREACH and CRIME.
Activity Over Time
Top Contributors
Keywords
Sample Comments
SSL isn't hiding anything if the attacker controls the client endpoint :)
tls isn't magic, you can still observe the encrypted stream and make assumptions based on bytes sent/received on the wire, protocol patterns and timing. See the crime and breach attack.
Aren’t TLS certificates also sent in plaintext?
I’m guessing it doesn’t work with TLS as it’d need the keys to decrypt the traffic
Wouldn't full SSL traffic be encrypted if leaked and therefore kind of irrlevant?
What you are describing does not make sense. TLS would be pointless if this were possible.
Not always. Lots of companies intercept and potentially modify TLS traffic between network boundaries.
just because it comes over TLS, doesn't mean it's true
Don't most implementations at least use TLS for their implementations to preserve a modicum of sanity there?
Is TLS really secure from the NSA?