Some services are slowly developing post quantum resistant protocols for their services like Signal or Tutanota. When will this be a thing for the web?
Currently being investigated by browser makers but not something they can just do on their own like Signal.
Here’s Chromium’s current proposal that they’re testing:
https://blog.chromium.org/2023/08/protecting-chrome-traffic-with-hybrid.html
This is really interesting, thanks
Do you know if Firefox and/or Safari have indicated if they’ll be supporting this scheme too?
Firefox definitely will once a standard is available
thank you for this article
There are solutions currently in development, but as far as adoption goes, most sites won’t use them until there is a real need.
Looking back 10 years ago, even HTTPS didn’t have widespread adoption like it does now.
Hmmm real need… we need it now, lots of traffic is being harvested now for cracking later.
Oh I fully agree. However, the people that control the purse strings in business will not take IT security seriously until something bad enough happens that it either makes the news or affects them directly.
True. I just think of the hubble program and how what we learned was that there were already a bunch of them pointing at earth. I think quantum computing will be the same. 127 qubit machines are now publicly available… so what’s available to the cia?
Idk if that will ever hit the bank accounts that matter
Using a symmetric pre-shared key based VPN can help mitigate this issue. While the actual HTTPS data will still use non-PQR cryptography, Wireguard’s XChaCha20 and OpenVPN’s AES-256-CBC are considered safe against quantum computers since they don’t use asymmetric cryptography.
Of course, you still need to trust the VPN provider.
Awesome! Thats good info, thanks!
“Lots”
Citation needed
Sources have dried up now that the Snowden’s and Assanges of the world have gone into hiding, but they definitely used to collect massive amounts of data for years.
The NSA capturing traffic for later decryption is mere speculation. They’re not exactly going to admit doing so and I doubt anyone is going to commit career suicide and flee to Russia just for getting this out. However, they’d be wasting money on servers if they weren’t doing it. There have been tons of bugs and vulnerabilities allowing decryption after the fact after weak RNGs and protocol bugs have been found. It wasn’t that long ago that a website using a paid certificate for encryption would only require one key per website per year to decrypt all traffic. Give it a year or five and a mid sized company can easily start brute forcing through 2005 style HTTPS keys for cheap. Surely those NSA billions are ahead of the curve.
With a little preselection based on the plaintext domain name or the IP address of the target, they could easily gather all relevant information while filtering out things like images and videos. That’s still a lot of data, but it’s manageable.
Who has an interest in cracking your https traffic to say, lemmy? If it’s a nationstate, they already have access to root private key certs and that attack angle will not be mitigated with “quantum” encryption. If it’s Capitalism, i.e. google-ads or whatever, then it’s a marginal utility issue. If they harvested some of your https traffic from 20 years ago, it’s pretty worthless as far as metadata for ad-targeting etc goes. I don’t really see what “quantum encryption” would gain you.
True it’s definitely tinfoil hat territory
I’m a nobody, and I don’t expect there’s anyone who wants to access my encrypted traffic, but someone out there is important enough to the right people that would love to get access to that kind of stuff.
Wouldn’t HTTPS automatically support it once TLS does?
It depends if the new encryption methods are compatible with the key exchange mechanism.
deleted by creator
