3 ms·

Wouldn't DV validate that your DNS resolved correctly, which non-certificate methods dont?

• gcp 10y ago
  Not only that, it also guarantees there's no MITM. HTTPS without certs means you are talking securely to your attacker :-)
  • tremon 10y ago
    It doesn't guarantee that, not without an explicit out-of-band certificate statement such as DANE. It only guarantees that the MitM you're talking to has gone through the additional trouble of getting an "official" certificate for the site you're trying to connect to.
    • gcp 10y ago
      Getting this "official" certificate is in principle impossible. Of course, in practice sometimes it is possible, but so would reasonably be attacks against DANE (if anyone were using it).