4 ms·
How does a self-signed certificate that hasn't been added to the browser as trusted, or signed by a trusted CA, guarantee anything? Save for additional network
by janosdebugs 3y ago
How does a self-signed certificate that hasn't been added to the browser as trusted, or signed by a trusted CA, guarantee anything? Save for additional network security measures anyone could intercept the connection and present you with their certificate to intercept traffic, just like with plain old HTTP.
The average user shouldn't be asked to trust a certificate either because they are incapable of making that decision. Technical people should know better and can be asked to add the certificate to their browser.
- yjftsjthsd-h 3y agoIt doesn't guarantee anything, that's why I said it should show up the same as no cert. The only point is to break passive MITM attacks, which is still better than nothing.
- janosdebugs 3y agoAh, I see what you mean. Well, the way things are going you'll have your wish as all HTTP-only sites will get a warning eventually.