3 ms·
Explain this to me, because one of us is misunderstanding https. As I understand it, the danger of a self-signed certificate is that you don't know if it was is
by cheald 16y ago
Explain this to me, because one of us is misunderstanding https. As I understand it, the danger of a self-signed certificate is that you don't know if it was issued by the site owner. You don't get the certificate authority's trust by proxy, but if the certificate is genuine, it's as secure as any level 3 ssl certificate. The only thing a CA certificate is guaranteed to get you is the ca's rubber stamp that they issued it.
- MichaelGG 16y agoYou said it yourself: "the danger of a self-signed certificate is that you don't know if it was issued by the site owner". In the case of someone attacking you on WiFi, that self-signed certificate wasn't issued by the site owner. It was issued by the attacker. If you happily ignore warnings, your browser will just setup a "secure" connection to the attacker. Then the attacker just creates another HTTPS connection to your actual destination, and proxies the content back and forth. Now, if the attacker can only read packets, then yes, the actual encryption is still secure. But in many places where an attacker can sniff (WiFi, on your Ethernet), they can also inject. There are lots of problems with CAs and the crappy verification that goes into most certificates. But having a CA cert for SSL still significantly raises the bar and limits the extent of an attack. (If one did get a signed cert for PayPal or Facebook, they couldn't just go and publish it in a program like Firesheep, as it'd get revoked pretty quickly.)