4 ms·
xupybd 5 hours ago: Why do we need SSL for =>static blogs.<=
by JPLeRouzic 4y ago
xupybd 5 hours ago: Why do we need SSL for =>static blogs.<=
- xupybd 4y agoYes that is what I asked but I think you might be misunderstanding the answer. If someone can hijack the DNS of a client, they can send the client to a totally different copy of the static site. The client will have no idea and the site could contain malicious code or information. With a certificate they will get an error saying this is not the correct site. That assumes there has been no CA tampering or that they haven't managed to hijack the DNS of lets encrypt either.
- JPLeRouzic 4y agoThanks for your answer. But how to trust our browsers? For example in Firefox there are as CAs: - Xramp security services, but it looks like their web site is not reachable [1] A related website [0] is even not on HTTPS? How this is supposed to be a valid CA? Yet if a certificate is signed by this CA, a browser will signal no warning (except if it tries to reach their OCSP end point). [0] http://xramp.com http://xramp.com [1] www.xrampsecurity.com
- xupybd 4y agoYou are exactly correct. It's building a chain of trust. If any link in that chain is compromised then you have a security hole. It's not perfect, much like locking your house only goes so far when someone can cut a hole in your wall and walk in.