3 ms·
"Hello, I'm the target server; definitely not a MITM attacker, no way, not at all." Without identification, this is as good as sending the data in plaintext - f
by Piskvorrr 14y ago
"Hello, I'm the target server; definitely not a MITM attacker, no way, not at all." Without identification, this is as good as sending the data in plaintext - for all you know, you may be communicating with a hostile proxy.
- willtheperson 14y agoAhh, good point. I wasn't clear. By not requiring ID, I meant Company name, state, city, etc. I'm realizing that what I'm wanting is to split the SSL cert into 2 aspects. One provides security and endpoint verification. The other verifies the actual person/company and potentially insures that any losses will be covered. It seems like this is pretty much the idea of an EV cert (more verbose entity ownership) but that costs a ton. I don't know about you, but I don't use the SSL cert to verify the legitimacy of a company. I do ensure it's there when sending sensitive information though.