Post #3018139
2026-01-06 13:27 UTC
@stf@chaos.social No, keys are not the problem. You need cross endpoint validation with certificates, the only side that does this at the moment is the client endpoint.
If you have signing capability on both endpoints you can start signing keys and other session data.
Servers in 99.99% of cases never-ever validates the client, unless we're talking extremely secure government systems with elaborate authentication schemes.
Replies (1)
-
@stf@chaos.social 2026-01-06 17:13
@Ichinin@infosec.exchange i'm not sure i follow, you refering to tls? the article the quote comes from does not. the quote itself points out a general issue that (m)tls might or might not have solved (depending on threatmodel).