15 points lostmsu 43 minutes ago 3 comments
Tiberium 8 minutes ago | parent
I honestly thought there would be some elaborate chain there, not "we forgot to use encryption"...
pixl97 5 minutes ago | parent
Honestly issues like this crop up pretty commonly. JWT alg:none for example. Or even older people forcing SSL to downgrade to encryption null.
In any system that provides security it should only be designed to run if the security is in use, and to fail immediately with no further action if the security is not used.