3 ms·
Yes, that is true. But the information gained by the server if it is rogue is limited, you aren’t directly sending the password. That is the point. Practically
by tinus_hn 5y ago
Yes, that is true. But the information gained by the server if it is rogue is limited, you aren’t directly sending the password. That is the point.
Practically the step of verifying the server is very hard because the client UI doesn’t provide a way; there is no agreement on what the certificate should be.