Hacker News new | ask | show | jobs
by mehta 3896 days ago
OpenSSL as you can guess is also open source. Having boringssl opensourced does not change anything.
2 comments
icebraining 3896 days ago
Google hadn't been using OpenSSL for most of their services; in fact, they discovered Heartbleed when studying the possible transition to OpenSSL from NSS; they ended up transitioning directly to BoringSSL.

This doesn't detract from your point, since NSS is also open source, it's just a factoid.

link
Thaxll 3896 days ago
Who knows that google was using OpenSSL?
link
aruss 3896 days ago
The security of a system should never rely on an attacker not knowing the details of the algorithm or implementation.

https://en.wikipedia.org/wiki/Security_through_obscurity

link
wolf550e 3895 days ago
It is possible to fingerprint a TLS stack using its behaviour that a sysadmin can't change. People knew it was openssl.
link