3 ms·
OTOH, Firefox - and other browsers - make a self-signed or expired SSL certificate look extremely scary, while a totally unencrypted connection is fine. I under
by JoachimSchipper 16y ago
OTOH, Firefox - and other browsers - make a self-signed or expired SSL certificate look extremely scary, while a totally unencrypted connection is fine. I understand the reason, but it´s still odd...
- arethuza 16y agoI would say that it is scarier - with a self signed cert you have someone claiming an identity without providing any independent confirmation, while providing an encrypted channel for that communication so that it "seems" safe.
- chrisbolt 16y agoWhy tie identity to encryption? Just have a self signed certificate not show a lock icon, or some new icon that represents encryption but not independently confirmed identity.
- wcoenen 16y agoBecause the value of encryption is significantly reduced if you don't know who you are talking to. How do you know you're not talking to a man in the middle?
- JoachimSchipper 16y agoYou don't. I agree that self-signed certificates are mostly useless (although stuff like the perspectives extension to Firefox might help in verification, and at least you can be sure that you are still talking to the same server), but that does not it's worse than a plain HTTP connection.