6 ms·
I get a cert error when trying to access the site.
by kelvie 12y ago
I get a cert error when trying to access the site.
- deleted 12y ago[deleted]
- agumonkey 12y agoreadable through printfriendly http://www.printfriendly.com/print/?source=site&url=blog.patternsinthevoid.net%2Freplacing-a-thinkpad-x60-bootflash-chip.html http://www.printfriendly.com/print/?source=site&url=blog.pat...
- exo762 12y agoThis is a self-signed cert. Pretty normal stuff for pages by hackers for hackers. Do you care who is running that site? Are you going to provide them any personal data? Were your browser hardened by you? If you answered no, no, yes then you are pretty safe.
- pestaa 12y agoStill pretty bizarre when properly signed certs for small sites are free of charge.
- nullc 12y agoHow kind of them to setup the site in a way which is indistinguishable from a MITM, so that its a common and usual thing and when there actually is a MITM against other sites you use you'll suffer from none of that uncomfortable alarm.
- bitJericho 12y agoHave you asked him if you could donate some money towards him getting a verified certificate?
- nullc 12y agoThey're free: https://www.startssl.com/ https://www.startssl.com/ The only reason to not have one are (misguided, IMO) principles, lazyness, ignorance, ... or there really is a MITM. :P
- LeoPanthera 12y agoWildcard certs (which that page uses) are not free.
- exo762 12y agoAlso, they (CA+cert) are broken beyond repair. I understand lulling users into false sense of security because they don't understand what they are doing, and scary message is scary. But CA chain is so insecure today, that I would rather trust cached cert, my 'convergence' setup or luck than happy green lock icon.
- joelanders 12y agoHer.
- bitJericho 12y agoMy apologies to the author for my mistake.
- technomancy 12y agoHow is that different from a plain HTTP site? It's just that your browser has chosen to interpret it in a misleading way.
- nullc 12y agoThe difference is that authentication was expected here. If you don't get authentication when it was expected and asked for that should be a red flag that something is amiss. Effectively this creates a chicken little situation where attacks are indistinguishable from common configurations. This lowers the costs of attacking because it reduces the risk of detection, it also makes attacks more successful because it trains users to click through the warnings.
- tinco 12y agoThis is not a misconfiguration, it is actually better to use a self signed certificate if you want to ensure authenticity even in the face of world power adversaries.
- drdaeman 12y agoIf one wants an opportunistic encryption, there're tcpcrypt or IPsec for that. If one wants to encourage others to blindly accept untrusted certificates from whatever server decides "to hell with authorities" - that's not a good idea. When those World Power Adversaries will consider messing with the site, visitors will already be trained to accept the certificate (hah!) If one really insists on self-signed certificate, there should be at least an HTTP (i.e. accessible without accepting anything!) page describing the reasoning behind the whole situation and providing means to validate the certificate. Like, say, a PGP signature of certificate in question, signed with a key that could be traced to site owner with reasonable level of trust. Or at least TLSA DNS records (dig says there're none).
- nullc 12y ago> If one wants an opportunistic encryption, there're tcpcrypt or IPsec for that. And HTTP/2.0 thankfully. OE is a good improvement, indeed, but it's not worth teaching users bad practices for the authenticated stuff.
- freehunter 12y agoIt shouldn't be normal stuff. If you don't have a trusted cert, don't even bother. You shouldn't be training people, even people who should know better, to click past a certificate warning page.