3 ms·

I'm one of those people that never checks the "click here to never show this again" box on RDP cert warnings so I'll chime in. In my mind, I know I really shou

I'm one of those people that never checks the "click here to never show this again" box on RDP cert warnings so I'll chime in. In my mind, I know I really should manually grab a copy of the cert from work so I'm actually certain I'm not being MITM'd, but on the other hand I know the likelihood of that being the case is pretty darn low and I'm lazy so I don't. But I make sure that warning keeps popping up because I don't want to forget that I'm doing something dangerous.

jiggawatts 6y ago
This method is much, much worse for security. It's literally the worst possible thing that you could do. The easy way is decently secure: if you tick the checkbox, it memorises the certificate serial number for you, the same as if you had manually trusted a self-signed cert. Any change to the certificate will show the warning again. This is comparable to trusting an SSH certificate the first time you connect to a host with Putty. The best way is to issue RDP Certificates from an Enterprise PKI: They're free, you never get warning popups ever again, and they're secure. Your method means that if the certificate changes (due to a MitM attack), you won't notice. The warning looks the same with a new certificate as an old certificate that you didn't choose to trust. You're 100% vulnerable and you've both hidden an a warning for an actual attack and also trained yourself to ignore all such warnings.
- p1necone 6y ago
  Thanks. I will rectify this now :)
- danaris 6y ago
  > The easy way is decently secure: if you tick the checkbox, it memorises the certificate serial number for you, the same as if you had manually trusted a self-signed cert. Any change to the certificate will show the warning again. This is comparable to trusting an SSH certificate the first time you connect to a host with Putty. Then it should say so. "Click here to never show this again"—never show for this certificate? For this connection? For any connection? Be clear and specific, even if it takes three more words.

jiggawatts 6y ago

This method is much, much worse for security. It's literally the worst possible thing that you could do. The easy way is decently secure: if you tick the checkbox, it memorises the certificate serial number for you, the same as if you had manually trusted a self-signed cert. Any change to the certificate will show the warning again. This is comparable to trusting an SSH certificate the first time you connect to a host with Putty. The best way is to issue RDP Certificates from an Enterprise PKI: They're free, you never get warning popups ever again, and they're secure. Your method means that if the certificate changes (due to a MitM attack), you won't notice. The warning looks the same with a new certificate as an old certificate that you didn't choose to trust. You're 100% vulnerable and you've both hidden an a warning for an actual attack and also trained yourself to ignore all such warnings.

p1necone 6y ago
Thanks. I will rectify this now :)
danaris 6y ago
> The easy way is decently secure: if you tick the checkbox, it memorises the certificate serial number for you, the same as if you had manually trusted a self-signed cert. Any change to the certificate will show the warning again. This is comparable to trusting an SSH certificate the first time you connect to a host with Putty. Then it should say so. "Click here to never show this again"—never show for this certificate? For this connection? For any connection? Be clear and specific, even if it takes three more words.