3 ms·
An invalid certificate is far more likely to be an attack than a misconfigured server. If Firefox silently accepted self-signed certificates, and presented the
by jmillikin 16y ago
An invalid certificate is far more likely to be an attack than a misconfigured server.
If Firefox silently accepted self-signed certificates, and presented the same UI as an unencrypted page, attackers could intercept requests to https://paypal.com/ https://paypal.com/ and very few users would ever notice.
Additionally, automatically accepting self-signed certificates would render ideas like "HTTPS-only cookies" useless, because now the browser would happily send them to anyone who asks.
- __david__ 16y ago> An invalid certificate is far more likely to be an attack than a misconfigured server. I don't believe that. I've run into tons of self signed/invalid certs that weren't attacks. If you're implicitly limiting your statement to large sites (paypal, amazon and the like) then you're probably right. But unqualified, it is definitely not the case.