4 ms·
Accepting any self-signed cert that gets presented is the same as not using certs in the first place. Just use http:// http://. If you pre-share or pin self-s
by IncRnd 9y ago
Accepting any self-signed cert that gets presented is the same as not using certs in the first place. Just use http:// http://.
If you pre-share or pin self-signed certs that can be useful but in a different use case.
- Jach 9y agoCome on, it's not literally the same. It at least requires an active attacker to read your data, whereas HTTP can be read passively.
- IncRnd 9y agoYou're right. It's not literally the same. However, it is effectively identical. It is absolutely trivial for even a 5 year old to click a button and perform a downgrade attack on this type of an https:// https:// connection. That is why accepting any self-signed certificates should be treated identically to http:// http:// connections.