3 ms·
I agree it sucks that there was no warning, but why would you be using self-signed certificates in this situation anyway? There's almost no benefit at all and i
by codeka 14y ago
I agree it sucks that there was no warning, but why would you be using self-signed certificates in this situation anyway? There's almost no benefit at all and in fact all it really does it give you a false sense of security that your connection is "secure" when in fact it's not.
- est 14y ago> There's almost no benefit at all There is, a cert under a CA could be hijacked by MITM (another CA gone rogue), while if a client stores the self-signed cert, it will always be that cert, no exceptions.
- nodata 14y agoWhy use self-signed certs? It depends how the client (here Gmail) handles them. If it asks you to approve the cert, and remember the approval, you get exactly the same amount of security as a non-self signed cert. iirc this is what Gmail did.
- aw3c2 14y agoSure there is a benefit! Unless you specifically are being targetted with a MITM, your mail will be save and encrypted anywhere between your originating server and Google's receiving server. No ISP or government router traffic harvesting.
- icebraining 14y agoIf the government wants to harvest your traffic, MITM'ing is not really a great impediment. It might be an impediment for your ISP because of the economic constraint it imposes, but even that is not certain.
- aw3c2 14y agoAs I said, this is no precaution about targetted attacks. It works well against the default packet inspection and probably also storage routers (can) do.
- crististm 14y agoRoot-signed certificates tell me only that someone paid money in exchange of "trust" in a certain trust-scheme. The fact is, the trust scheme currently implemented is broken and bad. A better system is a peer-based one, where self-signed certificates are "root" certificates.