4 ms·
Encryption without authentication is useless. It's mostly useless. Anyone trying to eavesdrop needs to expend slightly more resources, and needs to take the ri
by tbrownaw 16y ago
Encryption without authentication is useless.
It's mostly useless. Anyone trying to eavesdrop needs to expend slightly more resources, and needs to take the risk that there was some out-of-band authentication that they aren't aware of.
Firefox gets a lot of grief (from idiots) for refusing self-signed certificates by default, but it's a huge credit to their security team that they've resisted the pressure to ease up.
No, it mostly gets grief (from sane people) for not also refusing plain HTTP under the same pretenses.
- jmillikin 16y agoAn invalid certificate is far more likely to be an attack than a misconfigured server. If Firefox silently accepted self-signed certificates, and presented the same UI as an unencrypted page, attackers could intercept requests to https://paypal.com/ https://paypal.com/ and very few users would ever notice. Additionally, automatically accepting self-signed certificates would render ideas like "HTTPS-only cookies" useless, because now the browser would happily send them to anyone who asks.
- __david__ 16y ago> An invalid certificate is far more likely to be an attack than a misconfigured server. I don't believe that. I've run into tons of self signed/invalid certs that weren't attacks. If you're implicitly limiting your statement to large sites (paypal, amazon and the like) then you're probably right. But unqualified, it is definitely not the case.
- tptacek 16y agoPlain HTTP isn't lying to the end-user.
- jodrellblank 16y agoWould you support if browsers made password fields not-starred-out on HTTP sites? Just to make it clear that there is no implication of security there?
- tptacek 16y agoNo, because that would be stupid.