3 ms·
How would a browser know the difference between a self-signed certificate created by you and a self-signed certificate created by an attacker? You can create se
by janosdebugs 3y ago
How would a browser know the difference between a self-signed certificate created by you and a self-signed certificate created by an attacker? You can create self-signed certificates on the fly based on the SNI.
- yjftsjthsd-h 3y agoRight, obviously self-signed is worse than a proper cert. The argument is that even self-signed is better than no encryption (plain insecure HTTP), but browsers treat it as worse. The idea gets raised every now and again that self-signed certs should be treated exactly like no cert at all - no lock in the address bar, but also no big massive warning page screaming that this page is insecure.
- janosdebugs 3y agoHow does a self-signed certificate that hasn't been added to the browser as trusted, or signed by a trusted CA, guarantee anything? Save for additional network security measures anyone could intercept the connection and present you with their certificate to intercept traffic, just like with plain old HTTP. The average user shouldn't be asked to trust a certificate either because they are incapable of making that decision. Technical people should know better and can be asked to add the certificate to their browser.
- yjftsjthsd-h 3y agoIt doesn't guarantee anything, that's why I said it should show up the same as no cert. The only point is to break passive MITM attacks, which is still better than nothing.
- janosdebugs 3y agoAh, I see what you mean. Well, the way things are going you'll have your wish as all HTTP-only sites will get a warning eventually.
- cozzyd 3y agoIt requires a significantly more sophisticated attacker, for one, as opposed to just opening wireshark on a public network. Either way, it's at least not as scary as unencrypted http.