Schneier on Security

Chris S • November 30, 2009 7:01 AM

Bruce,
I’d be very interested on your take on the recent SSL protocol level re-negotiation vulnerability, and actually SSL in particular today as it seems like until now there was only “social engineering” type exploits and I’m sure people are wondering if SSL is ultimately safe now. I know on Linux forums people have been asking about crazy ideas they have for avoiding using SSL and it seems to me even if it’s got some vulnerability it’s likely better still than cooking up your own way to not use it. SSL (and SSH) is so pervasive now as to be of critical importance to the web.