3 ms·

A user agent must work for the user, not the server. Obeying the server over the user's intent is malicious design. And if that makes it pointless, then just r

A user agent must work for the user, not the server. Obeying the server over the user's intent is malicious design. And if that makes it pointless, then just remove it entirely. Believe it or not, I've never seen a cert error in the wild that wasn't an expiration of a valid cert or a misconfiguration. The boogeyman of MITM attacks which PKI certs protect from is used to justify a lot of terrible changes to the web that aren't reflected by reality: In most cases they're just going to hack the real server and serve malicious content from your valid certificate anyways. Or they'll trick someone into giving their credentials to bonkofamerica.com because people are easy to fool. Why MITM Amazon when people will happily treat an order email sent from a Gmail account as legitimate?

toomim 4y ago
Preach! Power to the User!
notriddle 4y ago
> I've never seen a cert error in the wild that wasn't an expiration of a valid cert or a misconfiguration. I have. Usually caused by a captive portal. > The boogeyman of MITM attacks which PKI certs protect from is used to justify a lot of terrible changes to the web that aren't reflected by reality. The move to use HTTPS everywhere was started in response to packet sniffing tools like Firesheep. That’s not a boogeyman; it’s a proof of concept that works in realistic scenarios. > Why MITM Amazon when people will happily treat an order email sent from a Gmail account as legitimate? So what? How about solving both problems?
- ocdtrekkie 4y ago
  Captive portals aren't malicious. They're arguably helpful. But I've never seen a captive portal using fake certificates either.
  - justsomehnguy 4y ago
    > But I've never seen a captive portal using fake certificates either. I never seen a captive portal using a valid certificate either. Not like I saw many captive portals (last time was like... 2018?) but still.
  - notriddle 4y ago
    Whether they’re malicious or not, I don’t want to send them the session cookie for an unrelated website.
    - saurik 4y ago
      So scope cookies to the SSL certificate instead of the domain name, or simply offer to clear them for a domain whenever you bypass the HSTS on one.
      - duskwuff 4y ago
        > So scope cookies to the SSL certificate And invalidate every user's session whenever the server's certificate is renewed??
  - Thorrez 4y ago
    >using fake certificates What's the definition of a fake certificate? Self signed? Signed by a real CA, but for a different domain (the captive portal operator's generally)?
Thorrez 4y ago
>I've never seen a cert error in the wild that wasn't an expiration of a valid cert or a misconfiguration. Here's one example: https://www.engadget.com/2018-04-25-hackers-dns-phishing-scam-cryptocurrency-myetherwallet.html https://www.engadget.com/2018-04-25-hackers-dns-phishing-sca...

toomim 4y ago

Preach! Power to the User!

notriddle 4y ago

> I've never seen a cert error in the wild that wasn't an expiration of a valid cert or a misconfiguration. I have. Usually caused by a captive portal. > The boogeyman of MITM attacks which PKI certs protect from is used to justify a lot of terrible changes to the web that aren't reflected by reality. The move to use HTTPS everywhere was started in response to packet sniffing tools like Firesheep. That’s not a boogeyman; it’s a proof of concept that works in realistic scenarios. > Why MITM Amazon when people will happily treat an order email sent from a Gmail account as legitimate? So what? How about solving both problems?

ocdtrekkie 4y ago
Captive portals aren't malicious. They're arguably helpful. But I've never seen a captive portal using fake certificates either.
- justsomehnguy 4y ago
  > But I've never seen a captive portal using fake certificates either. I never seen a captive portal using a valid certificate either. Not like I saw many captive portals (last time was like... 2018?) but still.
- notriddle 4y ago
  Whether they’re malicious or not, I don’t want to send them the session cookie for an unrelated website.
  - saurik 4y ago
    So scope cookies to the SSL certificate instead of the domain name, or simply offer to clear them for a domain whenever you bypass the HSTS on one.
    - duskwuff 4y ago
      > So scope cookies to the SSL certificate And invalidate every user's session whenever the server's certificate is renewed??
- Thorrez 4y ago
  >using fake certificates What's the definition of a fake certificate? Self signed? Signed by a real CA, but for a different domain (the captive portal operator's generally)?

Thorrez 4y ago

>I've never seen a cert error in the wild that wasn't an expiration of a valid cert or a misconfiguration. Here's one example: https://www.engadget.com/2018-04-25-hackers-dns-phishing-scam-cryptocurrency-myetherwallet.html https://www.engadget.com/2018-04-25-hackers-dns-phishing-sca...