3 ms·

I'd point out that currently, access to port 80 for a domain is access to a certificate for that domain. This means that, stupid or not, HTTPS essentially is a

by rocqua 9y ago

I'd point out that currently, access to port 80 for a domain is access to a certificate for that domain. This means that, stupid or not, HTTPS essentially is as secure as privileged ports are.

nly 9y ago
Slightly more secure, since you can have multiple A records on a domain and your domain verification should really check them all. It's more fair to say HTTPS is basically as secure as DNS. If someone hijacks your DNS for 5 minutes they can have a TLS cert from LetsEncrypt for your domain for 90 days