4 ms·
I was familiar with the reasons why using self-signed SSL didn't buy you anything, but hadn't really put together how it would completely weaken the whole ecosy
by mnutt 13y ago
I was familiar with the reasons why using self-signed SSL didn't buy you anything, but hadn't really put together how it would completely weaken the whole ecosystem until now. "Oh, that's just Verizon MITMing me like always..."
- dTal 13y agoSelf-signed certificates are perfectly useful. Weaker security is still better than no security at all. For example, even unauthenticated, SSL protects you from log analysis after the fact. MITM is not the only threat model. If it's a personal page (say, a public-facing login to your NAS) you can always check the SSL fingerprint too. You don't have to remember the whole thing, just remember a few characters and check that they're right.
- mnutt 13y agoSure, but browsers are perfectly right to throw up a giant red warning that says "THIS IS NOT OK". Otherwise MITMing will become commonplace, and users won't care.
- dTal 13y agoThat's all well and good - my point was that this "self-signed certs are equivalent to no security at all" meme is both common and wrong. [EDIT] pdkl95 said what I was trying to say more eloquently and in more depth.