5 ms·

I don't think there is any doubt that even with a self-signed certificate, HTTPS is more secure than HTTP. At the least, it makes interception/sniffing/modifica

I don't think there is any doubt that even with a self-signed certificate, HTTPS is more secure than HTTP. At the least, it makes interception/sniffing/modification a bit harder. Security, after all, is about making attacks more difficult and costly. Still there is good reason that browsers rub it in the users face when a site tries to use a self-signed certificate. The user has to be really really sure that this is expected (it is like the SSH "the remote host key has changed" warnings).

smanek 16y ago
Maybe I'm missing your answer there ... You just say: Still there is good reason that browsers rub it in the users face when a site tries to use a self-signed certificate but I don't see where you say what that good reason is. If a self-signed cert is more secure than plain HTTP, why make a self-signed cert more painful to use than plain HTTP?
- wladimir 16y ago
  Because with HTTP, there is no assumption of security at the side of the user, or at least there shouldn't be. With HTTPS (and the "lock symbol") there is. The people that really know what they're doing can click through the warnings and still do what they want. But casual users that assume https=safe have the chance to leave. I'm all for deprecating HTTP the same way they did with TELNET, and warning the user for every HTTP site they go to, but that's a wholly different discussion :)
  - goldmab 16y ago
    The browser could just not show the "secure" visuals, instead of making us click through another page.
    - wladimir 16y ago
      Well, the warnings are only shown once. Once you import the self-signed certificate into your keystore, it never bothers you again (unless the certificate changes). This is the right workflow you should follow with self-signed certificates, it is similar to SSH. You need to accept the certificate once. After manually verifying it is the right one, you're even more secure than trusting on a CA...
      - goldmab 16y ago
        It's a usability problem. Firefox (at least 3.x) does a full-on freak-out if the cert is untrusted, despite the fact that the site is no more unsafe than an unencrypted website. Your statements about what should happen are only true if you are requiring encryption for everything that you do. On the web, it's assumed (although most people don't actually know this) that your information is not secure unless you see the green bar or whatever the security visual is on your particular browser. This brings me back to smanek's point. We have three levels of security: no SSL, untrusted cert, trusted cert. Nothing about the first level is superior to the second level, except for the possibility of a false sense of security. Therefore, a browser should not freak out more in the second situation.
        burgerbrain 16y ago
        Ah, but HTTPS with unsigned certs are less secure than plain old HTTP. Or more accurately, for all intents and purposes they are exactly as secure, but carry an unearned sense of security. Unjustified senses of security are a very very dangerous thing.
        goldmab 16y ago
        That's exactly what I said. But if the browser doesn't show any indication that it's secure, the problem doesn't exist. The way some browsers behave, there's a very strong implication that a website with a self-signed cert is more likely to result in your information being stolen than a website with no encryption. And that's not true.
        burgerbrain 16y ago
        If the browser (or even the URL that got the user there) even so much as shows the string "https", that is a form of positive feedback. The only responsible way for a browser to act is to give a strong negative feedback, to more than offset any potential positive feedback.
        16y ago
ilcavero 16y ago
I think the problem is with firefox warning annoyance, in chrome you get a good short explanation of what's going on and a button to continue (plus a graphical indication afterward that https is somehow not working), on firefox on the other hand you get a warning with a hidden section where there is a button to open a pop-up window that will then allow you to download/view the certificate and press "confirm security exception". In summary, firefox exaggerated with their warning, I'm wondering if it is possible to do an addon to fix this.

smanek 16y ago

Maybe I'm missing your answer there ... You just say: Still there is good reason that browsers rub it in the users face when a site tries to use a self-signed certificate but I don't see where you say what that good reason is. If a self-signed cert is more secure than plain HTTP, why make a self-signed cert more painful to use than plain HTTP?

wladimir 16y ago
Because with HTTP, there is no assumption of security at the side of the user, or at least there shouldn't be. With HTTPS (and the "lock symbol") there is. The people that really know what they're doing can click through the warnings and still do what they want. But casual users that assume https=safe have the chance to leave. I'm all for deprecating HTTP the same way they did with TELNET, and warning the user for every HTTP site they go to, but that's a wholly different discussion :)
- goldmab 16y ago
  The browser could just not show the "secure" visuals, instead of making us click through another page.
  - wladimir 16y ago
    Well, the warnings are only shown once. Once you import the self-signed certificate into your keystore, it never bothers you again (unless the certificate changes). This is the right workflow you should follow with self-signed certificates, it is similar to SSH. You need to accept the certificate once. After manually verifying it is the right one, you're even more secure than trusting on a CA...
    - goldmab 16y ago
      It's a usability problem. Firefox (at least 3.x) does a full-on freak-out if the cert is untrusted, despite the fact that the site is no more unsafe than an unencrypted website. Your statements about what should happen are only true if you are requiring encryption for everything that you do. On the web, it's assumed (although most people don't actually know this) that your information is not secure unless you see the green bar or whatever the security visual is on your particular browser. This brings me back to smanek's point. We have three levels of security: no SSL, untrusted cert, trusted cert. Nothing about the first level is superior to the second level, except for the possibility of a false sense of security. Therefore, a browser should not freak out more in the second situation.
      - burgerbrain 16y ago
        Ah, but HTTPS with unsigned certs are less secure than plain old HTTP. Or more accurately, for all intents and purposes they are exactly as secure, but carry an unearned sense of security. Unjustified senses of security are a very very dangerous thing.
        goldmab 16y ago
        That's exactly what I said. But if the browser doesn't show any indication that it's secure, the problem doesn't exist. The way some browsers behave, there's a very strong implication that a website with a self-signed cert is more likely to result in your information being stolen than a website with no encryption. And that's not true.
        burgerbrain 16y ago
        If the browser (or even the URL that got the user there) even so much as shows the string "https", that is a form of positive feedback. The only responsible way for a browser to act is to give a strong negative feedback, to more than offset any potential positive feedback.
        16y ago

ilcavero 16y ago

I think the problem is with firefox warning annoyance, in chrome you get a good short explanation of what's going on and a button to continue (plus a graphical indication afterward that https is somehow not working), on firefox on the other hand you get a warning with a hidden section where there is a button to open a pop-up window that will then allow you to download/view the certificate and press "confirm security exception". In summary, firefox exaggerated with their warning, I'm wondering if it is possible to do an addon to fix this.