3 ms·

Based on his tweet it sure seems like he forgot to renew, and this isn't some kind of genius move to keep anyone honest. https://twitter.com/briankrebs/status/

• panarky 6y ago
  That tweet says "Despite what the browsers may be saying, the site is still safe to visit." Is it though? Asking people to ignore browser warnings seems like bad advice from a security expert.
  • k_sze 6y ago
    Yeah, I, too, found that to be a really odd piece of advice from a security expert. If I were the Brian (but I'm not), I would have asked followers to not trust the site until the certificate issue is fixed, even though I "know" my site is still safe. I think the properly cautious attitude is to consider all bets being off when a certificate is invalid for whatever reason. There is no guarantee what your visitors are actually getting.
    • marta_morena_28 6y ago
      Bias finds its way into every corner. And no, it's not safe unless you do some extensive analysis of the certificate in question. Is this actually a valid/genuine certificate, besides the timestamp? A normal user will have a hard time verifying that.
  • Mathnerd314 6y ago
    It's safe considering the threat model: the worst his site has seen is some DDOS attacks. With a MITM his site might end up hosting a 0-day, but hijacking is unlikely to begin with due to how low-profile his site is (outside of tech circles). And they'd have to attack DNS as well as his certificate.