3 ms·
Come on, it's not literally the same. It at least requires an active attacker to read your data, whereas HTTP can be read passively.
by Jach 9y ago
Come on, it's not literally the same. It at least requires an active attacker to read your data, whereas HTTP can be read passively.
- IncRnd 9y agoYou're right. It's not literally the same. However, it is effectively identical. It is absolutely trivial for even a 5 year old to click a button and perform a downgrade attack on this type of an https:// https:// connection. That is why accepting any self-signed certificates should be treated identically to http:// http:// connections.