What really breaks SSL?

[ronjor]

Author: Ivan Ristic, Director of Engineering at Qualys.

After years of being ignored -- which is an unusual situation for the protocol that secures the Web -- SSL became the focus of the interests of the security community at some point in 2008 or thereabout.

From then on, a couple of months wouldn't pass between discoveries of one flaw or another. Most problems were with the way SSL is implemented, with one notable exception (the SSL/TLS renegotiation gap) in the protocol itself. As a result of this attention, the effective security of SSL has been continuously improving.

https://www.net-security.org/secworld.php?id=11412

[J_L]

Attention is great, as seen in open-source code.