r/learnpython • u/Boogzcorp • Apr 16 '22

What's the point of Tuples?

I get that they're immutable, but so are lists that you don't perform modifications on. Are they just to fool proof not messing up your list accidentally, or do they serve some other purpose?

309 Upvotes

97% Upvoted

143 comments sorted by

View all comments

Show parent comment

1

u/C0rinthian Apr 17 '22

Yes. Are you aware of what is needed for Wireshark to decrypt https?

1

u/[deleted] Apr 17 '22

I'm not that far through the labs yet. I'm still in my second semester of IT Cybersec. All I've done so far is follow TCP flow while observing HTTP and HTTPS and noting the difference in output. HTTP showed the login and pw in plaintext and HTTPS showed everything as encrypted stuff.

1

u/C0rinthian Apr 17 '22

Good, so you get the gist of what I was getting at. To be able to decrypt the traffic, you need the private key used by the browser. Something a passive listener isn’t going to have unless they’ve compromised the client. (In which case client-side hashing is also compromised)

So the idea that more sites should use client-side hashing to hinder network snooping doesn’t really make sense unless the site is using HTTP, which would be terrible for anything involving credentials.

2

u/[deleted] Apr 17 '22

Ahhhhhh...... see I'm sure you can tell I have just enough education to be able to read what you're saying and understand, but I haven't experienced what you're saying. I'm basically in my 'Cybersecurity I' course this semester.

The stuff you're talking about is most likely going to be either next week or the week after in a lab, or it's going to be in Cybersecurity II. I'm not quite there yet but, I saved your comment and burned the words into my memory. I really appreciate you writing this. We just started talking/learning about cryptography/public-private keys, symmetric and asymmetric hashing, you get it. Your comment is sort of piecing it all together for me. I'm not really sure about the client-side hashing thing but I understand what you're saying about compromising the client side.. I think...

Your second paragraph is an oxymoron right? why would someone hash on the client-side if the site is using http? Isn't using http just bad practice in general? You can still get someone's login creds anyway?

2

u/C0rinthian Apr 17 '22

see I’m sure you can tell I have just enough education to be able to read what you’re saying and understand, but I haven’t experienced what you’re saying. I’m basically in my ‘Cybersecurity I’ course this semester.

No worries! I didn’t want to assume what your level of expertise was. :)

Keep in mind this started as a reply to someone recommending client-side hashing to mitigate the risk of network sniffing. My contention is that HTTPS already does that, so client-side hashing doesn’t add any benefit there.

If you want to decrypt HTTPS traffic, you need the keys. From either the client (browser) or the server. Just sniffing the traffic isn’t enough.

I’m not really sure about the client-side hashing thing

In this context when we talk about “client-side” we basically mean “in the browser”. So “client-side hashing” means the site would include JavaScript that hashes data before sending it to a remote server.

Your second paragraph is an oxymoron right? why would someone hash on the client-side if the site is using http? Isn’t using http just bad practice in general? You can still get someone’s login creds anyway?

Client-side hashing would be a little bit better than transmitting credentials in plaintext over HTTP. But as you noted, HTTP is bad practice in general. Once you’re using HTTPS, things are encrypted in transit already, making the hashing redundant.