3 ms·
Not only that, it also guarantees there's no MITM. HTTPS without certs means you are talking securely to your attacker :-)
by gcp 10y ago
Not only that, it also guarantees there's no MITM.
HTTPS without certs means you are talking securely to your attacker :-)
- tremon 10y agoIt doesn't guarantee that, not without an explicit out-of-band certificate statement such as DANE. It only guarantees that the MitM you're talking to has gone through the additional trouble of getting an "official" certificate for the site you're trying to connect to.
- gcp 10y agoGetting this "official" certificate is in principle impossible. Of course, in practice sometimes it is possible, but so would reasonably be attacks against DANE (if anyone were using it).