3 ms·
> Since the SSL certificates formerly used to protect access to Lavabit have been compromised, we recommend manually validating the serial number and fingerprin
by FiloSottile 13y ago
> Since the SSL certificates formerly used to protect access to Lavabit have been compromised, we recommend manually validating the serial number and fingerprint your computer received before using this website. [https://liberty.lavabit.com/ https://liberty.lavabit.com/]
What? If an active attacker is changing certificates on the fly, he's also surely able to change the values in the HTML content of the page.
This will add absolutely no security for the users, only false sense of security via complex-looking measures, and he should know this.
- sil3ntmac 13y agoHopefully liberty.lavabit.com uses a new uncompromised cert?
- dublinben 13y agoPresumably, but not an EV one. It might as well have been generated by the NSA at this point, for all we know.
- FiloSottile 13y agoThe point is that if it is uncompromised we are safe, if it isn't writing the fingerprint in the HTML will be of no help at all.