3 ms·
The man-in-the-middle can self-sign their own certs and present it to you as the site's own self-signed cert. Unless you have some way to verify self-signed cer
by laughinghan 6y ago
The man-in-the-middle can self-sign their own certs and present it to you as the site's own self-signed cert. Unless you have some way to verify self-signed certs out-of-band, they're useless.
- josephg 6y agoThey’re not useless. They stop passive adversaries, like the Australian government. They just don’t stop active adversaries. Browser security warnings imply https > http > self signed https. The correct order of should be https > self signed https > http.
- laughinghan 6y agoInteresting point. BTW I love your blog and your work on ShareJS :)
- throwaway525142 6y agoWe're getting there, HTTP is going to be marked as insecure in the future as well. It's just the massive amount of HTTP sites that couldn't get marked as insecure before, due to the then resulting warning fatigue in users.
- zhenyavinogrdov 6y agoAllowing untrusted certificates for https, and showing just a warning for them, would make it impossible for websites to ensure that their traffic is not intercepted