4 ms·
In my browser it is either/or though. I can have encryption and verification, or none of those. Technically it would be feasable to have encryption without veri
by BurnGpuBurn 4y ago
In my browser it is either/or though. I can have encryption and verification, or none of those. Technically it would be feasable to have encryption without verification, and thus without CA's. Why isn't that an option?
- Avamander 4y agoBecause encryption without verification is practically useless.
- SAI_Peregrinus 4y agoMore specifically, because encryption without verification allows for MITM and other chosen-ciphertext attacks which trivially break the confidentiality provided by the encryption. Encryption needs entity authentication (verifying who you're talking to), data authentication (verifying that the ciphertext has been created by one of the parties in the communication), and a cipher to provide confidentiality in practice.
- mort96 4y agoYou can do what you want by creating your own self-signed certificates. It's not that hard, just a couple of openssl commands. Browsers will throw up a big scary warning that the certificate can't be verified (as you'd expect), but most browsers let you click through that warning, and you get encrypted but unverified traffic.
- benlivengood 4y agoYou can set up your clients and servers to prefer and/or allow the NULL cipher.