3 ms·
This suggestion is very misguided. There is no point in using TLS if you can't authenticate the endpoint. Your encryption is but an illusion at that point.
by lawnchair_larry 9y ago
This suggestion is very misguided. There is no point in using TLS if you can't authenticate the endpoint. Your encryption is but an illusion at that point.
- ComputerGuru 9y ago> There is no point in using TLS if you can't authenticate the endpoint. Your encryption is but an illusion at that point You're falling for the same false dichotomy browser vendors have fallen for. There are two, disjoint factors: encryption and authentication. HTTPS provides encryption and recognized CAs provide authentication. HTTP provides neither. The encryption is most definitely NOT an illusion, it's real and it's working. But perhaps you meant to say "your security is but an illusion," which is a very different statement.
- lawnchair_larry 9y agoNo. Your communications are not secret. Your channel does not have confidentiality. You are sending the message directly to the adversary.