3 ms·
To put it bluntly: The inconvenience caused to you (and other users who might be able to make an informed decision when facing a certificate warning) is less im
by pfg 10y ago
To put it bluntly: The inconvenience caused to you (and other users who might be able to make an informed decision when facing a certificate warning) is less important than the risk that a non-technical user accepts a certificate mistakenly and falls victim to a MitM attack.
Oh, and every browser I'm aware of allows you to import CA certificates, so why not just do that once and get a nice, green lock?
I don't know many non-technical users who use SSH regularly, but even for technical users, I doubt too many check the fingerprint, so the TOFU property of SSH is still a problem. That being said, SSH's TOFU is not all that different from the process of installing a CA certificate in your browser so ... just do that.
- merb 10y ago> That being said, SSH's TOFU is not all that different from the process of installing a CA certificate in your browser so ... just do that. except that it's 10000 times easier and 10000 times easier to claim that the remote key and the key you just trusted is the same.