3 ms·

Self-signed certificates, trust on first use (or verify out of band) like SSH, works around most of this

• ethbro 9y ago
  Correct me if I'm wrong, but the signed server-identifying cert is swapped in TLS before the connection is encrypted, no? So it's not technically infeasible to have networking gear drop any connection which doesn't chain back to a government-approved root?
  • userbinator 9y ago
    So it's not technically infeasible to have networking gear drop any connection which doesn't chain back to a government-approved root? Yse, and that is a very scary thought. China is doing something similar already.
    • ams6110 9y ago
      You could use a VPN. If you live in a place like China that blocks VPNs, you are screwed, agreed.
  • cesarb 9y ago
    > Correct me if I'm wrong, but the signed server-identifying cert is swapped in TLS before the connection is encrypted, no? Only on old TLS versions. TLS 1.3 changed it so the server certificate is also encrypted.
    • catamorphismic 9y ago
      What about SNI?