2 ms·
Not quite. Pins are either built into the browser by the vendor, or assigned on first access AFTER a successful server authentication (via the cert). Pins are
by 45h34jh53k4j 10y ago
Not quite.
Pins are either built into the browser by the vendor, or assigned on first access AFTER a successful server authentication (via the cert).
Pins are trusted/verified through another channel.
SSH Tofu trust occurs pre server authentication. It has no defense against an ALWAYS mitm. Of course there are far less ALWAYS MITM for SSH than TLS.
You have no way of validating the pubkey you have written to known_hosts against anything else.
- bandrami 10y agoPins are either built into the browser by the vendor Right, sideband, and browsers do it manually for domains they consider "high value". It has no defense against an ALWAYS mitm For that matter nothing does, since at some point I downloaded my OS or browser (wherever my CA store is) to begin with.