3 ms·

I'd think that a cache of known keys (trust on first use), synchronized across devices using browser sync, would be quite effective at protecting against MITM a

I'd think that a cache of known keys (trust on first use), synchronized across devices using browser sync, would be quite effective at protecting against MITM attacks as long as your first access to a LAN server (on any computer you have) is safe. Additionally there are orders of magnitude less attackers to a computer on a LAN than an Internet-facing machine. In fact, unless I have untrusted boxes on my network or targeted attacks, I actually feel safe hosting HTTP services (and I'm doing so right now, more or less safely), and if someone is performing targeted attacks on my network they could just break in and clone my hard drives without having to bother MITMing my connections (I value the ability to access my data across dual-boots more than I value disk encryption through Bitlocker or Linux-specific methods).

bawolff 3y ago
> I'd think that a cache of known keys (trust on first use), synchronized across devices using browser sync, would be quite effective at protecting against MITM attacks How do you distinguish between a host you have seen before that has a mismatched key vs a totally new host which you have never seen before. I guess it depends on how you are discovering these resources in the first place, but traditional answers like IP address are much less workable on the local network.
- skissane 3y ago
  If I buy a new computer, I’m expecting an untrusted key message the first time I SSH to it. Whereas, if suddenly I got that message with an existing box, I’d start investigating. How would trust-on-first-use for HTTP on local network be any different from SSH on local network?