3 ms·
ok, so are you also saying that it is impossible for an attacker to intercept data from a standard HTTP request? My next point being that if standard HTTP is a
by tcarnell 14y ago
ok, so are you also saying that it is impossible for an attacker to intercept data from a standard HTTP request?
My next point being that if standard HTTP is also vulnerable to such attacks, why doesn't the browser display a warning on EVERY page, telling us that it can not verify the website identify? Thus, all things being equal, I would assume that unverified, but encrypted is still better for the user than unverified AND unencrypted.
...but I've probably misunderstood something fundamental here (as is often the case!)
- mooism2 14y agoHTTPS claims to secure the connection, so it is necessary to make clear when these claims aren't justified. HTTP makes no security claims, no there's no "unexpected lack of security" to disclose.
- dchest 14y agoImagine that you're trying to connect to https://mail.google.com https://mail.google.com. Your browser receives a self-signed certificate. What should it do?