4 ms·
SSL documentation in most major projects still needs a lot of polishing. I also think there needs to be a push to separate the encryption and remote server ver
by a2tech 17y ago
SSL documentation in most major projects still needs a lot of polishing.
I also think there needs to be a push to separate the encryption and remote server verification parts of SSL/TLS. I'd love to encrypt all communication with the sites I run, but am completely uninterested in coughing up cash for an SSL cert.
- gthank 17y agoThen generate your own certs and self-sign.
- axod 17y agoStill pops up warnings for users in browsers.
- chowmeined 17y agoAs they should. Since there is no way to verify the remote server then the connection is vulnerable to man-in-the-middle attacks. In that situation an attacker can simply pretend to be the server and decrypt your traffic.
- jcl 17y agoAs I understand it, self-signed certs leave you open to man-in-the-middle attacks. http://news.ycombinator.com/item?id=277284 http://news.ycombinator.com/item?id=277284