3 ms·
It'd be nice to get a warning where the lock symbol goes at least, telling you that the connection is only secure because an additional cert got added. Maybe wi
by extraduder_ire 3y ago
It'd be nice to get a warning where the lock symbol goes at least, telling you that the connection is only secure because an additional cert got added. Maybe with an option to get warned when it first happens, so your browser doesn't just send along cookies.
Worst thing to me about enterprise certs is when people get tricked into installing them because a captive portal says that's the only way they can get their iphone on the free wifi.
- zzo38computer 3y agoI think it would be sense that the browser should never send cookies if the certificate changed unless the user specifies that the new certificate is valid for the existing cookies (or manually copies them if necessary, e.g. due to a different domain name or a different computer). This way, it willl be secure. HSTS is no good, but cookies being secure-only can help (although I dislike that cookie flag and think instead, it should be if the connection that sent the cookies to you is secure instead). I also think that, to save energy (and to work-around compatibility issues), you should be allowed to configure it to use insecure proxies for secure connections (usually these insecure proxies would run on your computer, or LAN, but this is not strictly required).
- bombcar 3y agoI wonder if cookies could be encrypted with the public key of the sites certificate - then when/if the certificate rotates, the cookies are worthless. You’d have to login again, but they couldn’t be stolen silently.