<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">26.03.2018 07:08, Amos Jeffries пишет:<br>
</div>
<blockquote type="cite"
cite="mid:59739641-f599-fa54-ab16-26a2b31b37a3@treenet.co.nz">
<pre wrap="">On 26/03/18 13:44, Yuri wrote:
</pre>
<blockquote type="cite">
<pre wrap="">
26.03.2018 06:41, Yuri пишет:
</pre>
<blockquote type="cite">
<pre wrap="">
26.03.2018 06:30, Amos Jeffries пишет:
</pre>
<blockquote type="cite">
<pre wrap="">On 26/03/18 12:34, Yuri wrote:
</pre>
<blockquote type="cite">
<pre wrap="">26.03.2018 05:23, Amos Jeffries пишет:
</pre>
<blockquote type="cite">
<pre wrap="">On 26/03/18 12:07, Yuri wrote:
</pre>
<blockquote type="cite">
<pre wrap="">26.03.2018 05:05, Amos Jeffries пишет:
</pre>
<blockquote type="cite">
<pre wrap="">On 26/03/18 11:05, Yuri wrote:
</pre>
</blockquote>
</blockquote>
</blockquote>
</blockquote>
</blockquote>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">
On 26/03/18 12:34, Yuri wrote:>
</pre>
<blockquote type="cite">
<pre wrap="">26.03.2018 05:23, Amos Jeffries пишет:
</pre>
<blockquote type="cite">
<pre wrap="">This is what I mean by "TLS used properly" - proper is when it always
circles back to user deciding who they trust. No matter how indirectly,
the user installs a (root) CA causing trust or allowed someone else to
do so.
</pre>
</blockquote>
<pre wrap="">Generally speaking, yes.
I just mean, that in some other protocols you have no any possibility to
make MiTM by any way, whenever installing something or not. This
prevents any improper or malicious use of protocol.
TLS*have* this possibility. SSH is *not*. You can't MiTM or compromise
SSH by installing any key/certs to client. Correct? This is by design?
</pre>
</blockquote>
<pre wrap="">No. SSH is just TCP/telnet over TLS. So if the SSH software were to
trust the cert/key Squid delivers one could use SSL-Bump on that SSH
traffic.
</pre>
</blockquote>
<pre wrap="">You sure?
<a class="moz-txt-link-freetext" href="https://stackoverflow.com/questions/723152/difference-between-ssh-and-ssl-especially-in-terms-of-sftp-vs-ftp-over-ssl">https://stackoverflow.com/questions/723152/difference-between-ssh-and-ssl-especially-in-terms-of-sftp-vs-ftp-over-ssl</a>
Quote: "SSH has its own transport protocol independent from SSL, so that
means SSH DOES NOT use SSL under the hood."
Because I'm not. Different sources tells opposite.
</pre>
</blockquote>
<pre wrap="">I'm sure SSH using openssl under the hood. But not sure it uses same
tunneling implementation like TLS-over-HTTP. And now it is still unknown
any method to MiTM SSH, AFAIK.
</pre>
</blockquote>
<pre wrap="">
I'm not 100% sure, but it uses the same message framing as TLS and
performs the same handshake sequence and security verifications.</pre>
</blockquote>
This is not the same as transport, yes? Because of transport is
primary target for bumping.<br>
<blockquote type="cite"
cite="mid:59739641-f599-fa54-ab16-26a2b31b37a3@treenet.co.nz">
<pre wrap="">
That said *SSL* _is_ different from TLS so the quote is technically
correct either way.</pre>
</blockquote>
<span id="result_box" class="" lang="en"><span>It seems to me that
the difference is not of principle.</span> <span>Both SSL and
TLS use the same architecture, in which, in principle, it is
possible to have an MiTM certificate, which one of the parties
trusts.</span></span>
<blockquote type="cite"
cite="mid:59739641-f599-fa54-ab16-26a2b31b37a3@treenet.co.nz">
<pre wrap="">
Amos
_______________________________________________
squid-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a>
<a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
"C++ seems like a language suitable for firing other people's legs."
*****************************
* C++20 : Bug to the future *
*****************************</pre>
</body>
</html>