3 ms·
HTTPS is about securing the connection to the website and NOT about identifying the website. It is sufficient for ensuring that intermediaries (e.g. your ISP) c
by bad_user 8y ago
HTTPS is about securing the connection to the website and NOT about identifying the website. It is sufficient for ensuring that intermediaries (e.g. your ISP) cannot meddle with the content being served (i.e. it's a form of signing the content for publishers), it ensures that the browsing stays private (with new DNS developments, the domain name stays private too) and it secures the data being sent (e.g. passwords).
Nothing is sufficient for total security, but "HTTPS everywhere" is a vast improvement, going from zero security to almost sufficient security over night.
- swebs 8y ago>HTTPS is about securing the connection to the website and NOT about identifying the website. Unfortunately, it's both. Otherwise we would have had widespread encrypted connections decades ago. I'm not sure why browsers decided that no encryption is just fine, but encryption with a self-signed certificate triggers warnings that it's the end of the world.
- lordlimecat 8y agoBecause negotiated encryption is useless if you can't be sure you're talking to the right person. If you are using a self-signed cert with an unknown thumbprint, how does the other side know you aren't a MITM attacker?