3 ms·
> Am I supposed to trust them more than some man-in-the-middle just because they own a domain name? The green padlock will not turn any unreliable fake news si
by afiori 6y ago
> Am I supposed to trust them more than some man-in-the-middle just because they own a domain name?
The green padlock will not turn any unreliable fake news site of your choise in a trustworthy outlet but it does make some guarantees about it being the same site as yesterday (barring security leaks or missed DNS renewal)
AFAIU the elefant in the room is that if your DNS resolver is malicious and points all domains to a malicious IP then https is completely useless.
- globular-toast 6y ago> but it does make some guarantees about it being the same site as yesterday No it doesn't. Are you thinking of TOFU via public key pinning?
- afiori 6y agoI was oversimplifying my limited understanding. What I belive should be true is that you are connecting to a server that: 1. managed to obtain a valid certificate from some recognized autority 2. managed to steal a valid certificate for the domain in question from another server 3. managed to convince enough DNS resolvers to point to their IP for a given domain (so to get your traffic and/or pass LE challenges) and/or other conditions. From an operational perspective it says very little, especially considering the third case where any public wifi network has in most cases total initial control over your DNS traffic.
- josephcsible 6y ago> if your DNS resolver is malicious and points all domains to a malicious IP then https is completely useless. 100% false. HTTPS absolutely protects against that.