3 ms·
What about the first time the user connects, how would they be assured that the fingerprint really is the site's and not a man in the middle? Honest question,
by blaenk 14y ago
What about the first time the user connects, how would they be assured that the fingerprint really is the site's and not a man in the middle?
Honest question, myself being pretty new to cryptography.
- e1ven 14y agoIn theory, you could do an out-of-band comparison. In practice, you'd generally accept that the first one you receive is valid, and then watch for deviations from there. This is the way SSH works, for instance.