4 ms·
This one in particular feels very strange, since there's actually nothing bad actively happening with the connection, it's more of a policy decision.
by r1ch 10y ago
This one in particular feels very strange, since there's actually nothing bad actively happening with the connection, it's more of a policy decision.
- coldpie 10y agoMy understanding is that you can't know that nothing bad is actively happening with the connection since SHA-1 is no longer a strong hash, so it's basically (hand-wave) no different from an HTTP connection.
- bandrami 10y agoSo why don't they present any warning on HTTP connections? It's not "basically no different" from an HTTP connection, it's strictly better than an HTTP connection, but not as good as a cert made with a more modern hash. (For that matter the same argument applies to self-signed certificates: you're still keeping a third party from snooping on the phishing attempt the MITM is giving you, which is itself a Good Thing.)
- coldpie 10y agoI agree, insecure HTTPS should be treated like HTTP. But this issue has been argued to death, especially over self-signed certs, and our side lost.
- kevincox 10y agoAll major browsers are moving towards this. Starting with the tiny icons changing colors they are beginning to make HTTP as insecure. Yes, it's very slow but at least they have started moving.