3 ms·
>> Isn't this the direction newer protocols are taking? AFAIK HTTP 2.0 is always encrypted (even if no SSL cert is installed) Using ad-hoc certificated is as s
by hobarrera 12y ago
>> Isn't this the direction newer protocols are taking? AFAIK HTTP 2.0 is always encrypted (even if no SSL cert is installed)
Using ad-hoc certificated is as safe as using STARTTLS: a MITM can just put his own cert (similar to a MITM removing the STARTTLS capability announcement from the client to the server). It's actually worse, since the client will think it's communication is safer than it actually is.
- Karunamon 12y agoThis is a matter of UI design, then. Eventually I'd expect secure sites to be the default (with broken lock symbols in the URL bar if not), with higher levels of security carrying something like the secure site symbols we see today. Encryption and identity assurance are two different things - you can easily have the first which makes passive monitoring much more difficult without the trust infrastructure to mitigate MITMing. For the average user, knowing what we know now, I'd say the first is a much more clear and present danger. The second requires a person to actually take interest in your traffic.