3 ms·

"Is it safe? ... Unless you install your own CA certificate in the browser or in the root certificate store of whatever other technology you use, they will comp

by akerl_ 12y ago

"Is it safe? ... Unless you install your own CA certificate in the browser or in the root certificate store of whatever other technology you use, they will complain about not being able to validate the certificates. This does not mean they are unsafe, just that they don't know to trust the certificates." Not being able to trust that you're talking to who you think to are seems like a serious example of "not safe". Teaching users to click through the warning screen is a serious anti-pattern; the reason browsers keep making it scarier / harder is to try to stop the security theatre that occurs when using untrusted certs.

robbiet480 12y ago
Instantly clear to me that this is for internal tooling use only. "For what would I use TinyCert certificates? Any place you would use (or should have used) self-signed certificates. Don't leave admin panels, such as phpMyAdmin, a CMS or a webmail install without some protection to keep your password from being intercepted. Use them to protect your test and development installations. Use them on your local POP or IMAP servers. Or use them to test your own code involving certificates." - https://www.tinycert.org/faq#use https://www.tinycert.org/faq#use
shdon 12y ago
Untrusted, fraudulent and unsafe are three entirely different things. Just because the browser doesn't trust the certificate does not mean it is unsafe or fraudulent. You as the end user can verify whether the certificate the browser presents is the one you installed yourself and as such whether you're talking to who you think you're talking to. I can't control what people do with the certificates, but I'm recommending against the use of TinyCert certificates for the public web. When used as intended, only people who have themselves generated and installed the TinyCert certificates (or their associates if so instructed) will see them and click past. Anybody else should get the big scary warning and will hopefully, rightfully, heed it.

by akerl_ 12y ago

robbiet480 12y ago

Instantly clear to me that this is for internal tooling use only. "For what would I use TinyCert certificates? Any place you would use (or should have used) self-signed certificates. Don't leave admin panels, such as phpMyAdmin, a CMS or a webmail install without some protection to keep your password from being intercepted. Use them to protect your test and development installations. Use them on your local POP or IMAP servers. Or use them to test your own code involving certificates." - https://www.tinycert.org/faq#use https://www.tinycert.org/faq#use

shdon 12y ago

Untrusted, fraudulent and unsafe are three entirely different things. Just because the browser doesn't trust the certificate does not mean it is unsafe or fraudulent. You as the end user can verify whether the certificate the browser presents is the one you installed yourself and as such whether you're talking to who you think you're talking to. I can't control what people do with the certificates, but I'm recommending against the use of TinyCert certificates for the public web. When used as intended, only people who have themselves generated and installed the TinyCert certificates (or their associates if so instructed) will see them and click past. Anybody else should get the big scary warning and will hopefully, rightfully, heed it.