3 ms·
Encryption is only half the problem, authentication is the other. Self signed certificates don't authenticate the web server and allowing them would open the we
by samwillis 13y ago
Encryption is only half the problem, authentication is the other. Self signed certificates don't authenticate the web server and allowing them would open the web up to MITM attacks. What we need is some form or decentralised certificate authority, i have no idea how that could work though.
HTTP allready supports LZMA, its just the browser and web servers that dont. If a browser sent the header:
Accept-Encoding: compress, gzip, lzma
instead of:
Accept-Encoding: compress, gzip
and the server supported it, it would "just work". Unfortunately none of the major browsers or server have implemented it.
- Sephr 13y agoUnencrypted HTTP is already open to MITM attacks. What I proposed was using self-signed certificates in conjunction with certificate pinning, which means that as long as your first connection to a website isn't MITMed, later connections cannot be MITMed or snooped on. As for the compression, I was referring to LZMA for header compression. I am well aware of implementation efforts of LZMA in Firefox and Chrome.
- skrause 13y agoWhat we need is some form or decentralised certificate authority, i have no idea how that could work though. DNSSEC could be used to distribute certificates: https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...
- jimktrains2 13y agoIsn't DNSSEC still have centralized certs for the tlds?