3 ms·
Doesn't change the fact that it pops up a scary unintelligible message and makes you jump through hoops whenever someone tries to visit a site with a self-signe
by halo 18y ago
Doesn't change the fact that it pops up a scary unintelligible message and makes you jump through hoops whenever someone tries to visit a site with a self-signed certificate. It's very much a "break the web" situation.
As suggested by the original article, the correct behaviour would be to treat it as though there's no security whatsoever. After all, logically, how is being encrypted but unauthenticated worse than being unencrypted and unauthenticated?
- tptacek 18y agoHow can your browser tell the difference between: (1) A connection to onlinebanking.bankofamerica.com in which an attacker has hijacked the SSL handshake and subbed in a self-signed certificate, and (2) A connection to https://login.ratemykitten.com https://login.ratemykitten.com? You appear to be arguing that the warning for this situation should be tuned to (2).