3 ms·
I agree that TLS has little value if you can't verify who you're talking to. But at the very least, it's no worse than unencrypted HTTP. So it doesn't make sens
by dlubarov 10y ago
I agree that TLS has little value if you can't verify who you're talking to. But at the very least, it's no worse than unencrypted HTTP. So it doesn't make sense to me that browsers are more stern about untrusted certs.
- deadbunny 10y agoIt's treated as worse because if people get used to clicking "accept" for self signed then they'll do the same when they get MITM'd. Want an example? Any error dialogue.
- Dylan16807 10y agoSo you think the current browser behavior, with a scary warning and an accept button, is bad? If they were treated like http there would be no dialogue.
- catdog 10y agoIt still protects from passive wiretapping which is strictly better than no encryption at all. It's a shame browsers are treating it way worse.
- TazeTSchnitzel 10y agoNot quite. If you are given an HTTPS link, you should expect security. Passive upgrade from HTTP to HTTPS would be a different thing.
- dlubarov 10y agoFair point - if the browser is displaying the protocol in the URL bar that is. I believe Edge and Safari don't. Chrome and Firefox seem to display https:// https:// but not http:// http://. In the case of Chrome visiting an untrusted CA, it already displays https:// https:// in red with strikethrough, which seems like a perfectly adequate way to negate any expectation of security. So the scary warning which takes two clicks to pass seems like overkill. If I was making a browser, I'd just show a "secure" symbol for valid, trusted certs, an "insecure" symbol for anything else, and no protocols in the URL bar.