Comment by viraptor
5 months ago
QUIC uses TLS1.2 (or higher), so the guarantees are the same as for HTTPS streams. That means it protects the data streams against MitM.
5 months ago
QUIC uses TLS1.2 (or higher), so the guarantees are the same as for HTTPS streams. That means it protects the data streams against MitM.
Not any different from TLS.1.2 over TCP.
https://en.wikipedia.org/wiki/File:HTTP-1.1_vs._HTTP-2_vs._H...
Here is good intro for you:
The Security Challenges of HTTP/3 and QUIC — What You Need to Know https://medium.com/@RocketMeUpCybersecurity/the-security-cha...
Not if they have a root cert.
That's not a property of QUIC. Yes, if you trust both sides, then you trust both sides. That's not what people normally understand as MitM.
Pre-cert usage/issuance lists, it would take a keen eye to spot auto-mitm using root certs.
If China uses a root cert to issue bogus certs, that'll get caught by certificate transparency. Assuming people use browsers that enforce certificate transparency.
Kazakhstan literally forced their own cert for lots of popular sites for a while, expecting users to click the through and accept them. It was made illegal to not accept government certificates.
2 replies →