4 ms·
That's exactly what I am saying, HTTPS is not a protection for the server, but for the client.
by JPLeRouzic 4y ago
That's exactly what I am saying, HTTPS is not a protection for the server, but for the client.
- accrual 4y agoIt protects both. The server wants to ensure the client gets the intended data, and the client wants to ensure it gets the data the server intended to send. Neither side wants a situation where the message can be tampered with.
- kevincox 4y agoNo one except for you is talking about protecting the server.
- JPLeRouzic 4y agoxupybd 5 hours ago: Why do we need SSL for =>static blogs.<=
- xupybd 4y agoYes that is what I asked but I think you might be misunderstanding the answer. If someone can hijack the DNS of a client, they can send the client to a totally different copy of the static site. The client will have no idea and the site could contain malicious code or information. With a certificate they will get an error saying this is not the correct site. That assumes there has been no CA tampering or that they haven't managed to hijack the DNS of lets encrypt either.
- JPLeRouzic 4y agoThanks for your answer. But how to trust our browsers? For example in Firefox there are as CAs: - Xramp security services, but it looks like their web site is not reachable [1] A related website [0] is even not on HTTPS? How this is supposed to be a valid CA? Yet if a certificate is signed by this CA, a browser will signal no warning (except if it tries to reach their OCSP end point). [0] http://xramp.com http://xramp.com [1] www.xrampsecurity.com
- xupybd 4y agoYou are exactly correct. It's building a chain of trust. If any link in that chain is compromised then you have a security hole. It's not perfect, much like locking your house only goes so far when someone can cut a hole in your wall and walk in.
- deleted 4y ago[deleted]