4 ms·
> There has to be some initial root point of trust. For security critical web apps, this makes sense. For mere documents and simple sites without authenticatio
by Santosh83 5y ago
> There has to be some initial root point of trust.
For security critical web apps, this makes sense. For mere documents and simple sites without authentication or sensitive information, self-signed certificates should become acceptable, IMO.
- theandrewbailey 5y agoHow does a browser know which URLs are 'critical web apps' so that it can, if necessary, throw a big scary warning to the user? What stops a random website from self-identifying as critical (or not)? The S in HTTPS guarantees things. If those guarantees are loosened, that can cause bad problems.