4 ms·

What's encryption without authentication? Encryption ensures that only the entity you are sending the message to can read it. If you can't be sure of the entit

• wmf 18y ago
  Firefox 2 behaved similar to other browsers, giving one warning dialog for self-signed certs. People are complaining because Firefox 3 changed that to an annoying 4-step process.
• aristus 18y ago
  Encryption without authentication is just that: encryption. The point of encryption is to make sure no one else is listening OR modifying the data in transit. Like, say, your cash-starved ISP, or the government.
  • grhino 18y ago
    Without authentication, it could be your cash-starved ISP, or the government, which is generating a self-signed certificate.
  • tlrobinson 18y ago
    No, it's not. If a man-in-the-middle attack is possible (certainly the ISP could), then encryption without authentication is as insecure as no encryption at all. And in fact worse if the user has a false sense of security. The MITM pretends to be the bank's server (or whatever) when talking to you, and pretends to be you when talking to the bank's server. Both channels can be encrypted, but the attacker still sees (and can modify) everything that you think you're sending directly to the bank's server. This is the key point that most people seem to be missing here. If browsers didn't warn about self-signed certificate, the entire system would break down because an attacker could just use a self-signed cert in a MITM attack, and the user would have no idea.
• notauser 18y ago
  Authentication takes two forms: Am I talking to this guy. Am I talking to the same guy as yesterday. << Anonymous certificates handle this use case.