Hacker News Reader

Comment by jvehent | Hacker News Reader

I guess creating a bug bounty program is an easier way of pretenting that you care than actually fixing your broken TLS...

    $ ./cipherscan united.com
    prio  ciphersuite             protocols              pfs                 curves
    1     RC4-SHA                 TLSv1,TLSv1.1,TLSv1.2  None                None

View on HN

How will the NSA/CIA get "unofficial" access to the travellers data if they step up their encryption?

Why would they need to get it from United when the government already has it through TSA SecureFlight?

I love how everyone is focused on the NSA and CIA as threats, to the exclusion of all other possible threats. If the US government wants to steal my credit card number, they can just tax me, that's a legitimate power they have. If they want to stop me from going somewhere, they can just arrest me at the TSA checkpoint. Setting up a MITM and breaking TLS, while possible, is way too much effort to gain something they can already gain in a perfectly straightforward way. It's like killing ants on the White House lawn by poisoning them via fracking.

The threat model for bugs in United is primarily non-governmental thieves.

What you said doesn't invalidate what I said. Are the intelligence agencies allowed to have that data at all? Because if they aren't they will try and get it using unofficial channels.

Reply on news.ycombinator.com