6 ms·
OpenSSL as you can guess is also open source. Having boringssl opensourced does not change anything.
by mehta 11y ago
OpenSSL as you can guess is also open source. Having boringssl opensourced does not change anything.
- Thaxll 11y agoWho knows that google was using OpenSSL?
- aruss 11y agoThe security of a system should never rely on an attacker not knowing the details of the algorithm or implementation. https://en.wikipedia.org/wiki/Security_through_obscurity https://en.wikipedia.org/wiki/Security_through_obscurity
- wolf550e 11y agoIt is possible to fingerprint a TLS stack using its behaviour that a sysadmin can't change. People knew it was openssl.
- icebraining 11y agoGoogle hadn't been using OpenSSL for most of their services; in fact, they discovered Heartbleed when studying the possible transition to OpenSSL from NSS; they ended up transitioning directly to BoringSSL. This doesn't detract from your point, since NSS is also open source, it's just a factoid.