4 ms·

HTTP traffic would be unencrypted, so everyone (esp. on Wifi) could record passwords etc. flying around. With HTTPS, you at least need to MITM the connection to

by filmor 6y ago

HTTP traffic would be unencrypted, so everyone (esp. on Wifi) could record passwords etc. flying around. With HTTPS, you at least need to MITM the connection to do that. If you establish trust in some other way (cert ID printed on the device?), the connection is secure.

riskable 6y ago
Not just intercept: Using HTTPS prevents messing with the connection in-flight. So an attacker won't be able to inject their own payload into that web page you just requested.
- CountSessine 6y ago
  Except you’re using garbage certificates so anyone could MITM you and inject whatever they like.
  - bavell 6y ago
    In what way are self-signed certs garbage? They're essentially the same as ssh certs.
    - deleted 6y ago
      [deleted]
  - samus 6y ago
    That's a separate kind of attack, not intrinsic to the protocol. If the keypair got leaked or a CA misbehaves and issues multiple certificates that can be used for a host, then yes, it can happen.