3 ms·
This is a great step, one that I've been hoping for. Of course encryption without authentication is much worse than true encrypted transport (as in, with authen
by pavpanchekha 12y ago
This is a great step, one that I've been hoping for. Of course encryption without authentication is much worse than true encrypted transport (as in, with authentication), since it only prevents passive adversaries, but any sort of encrypted transport is better than plaintext. I'm also hoping this will ease the transition to TLS, since you can get it up and running without worrying about mixed-resource problems, then fix those one at a time.
- orthecreedence 12y agoI'd argue that the CA system is false authentication because it's fairly easy for the right players to tamper with. In that case, unauthenticated/encrypted transport is only a little less safe than "authenticated"/encrypted transport, but with the latter giving a higher illusion of safety than the former. The only real trust that would work is distributed trust. The CA system is kind of a joke. That said, yes, it does protect coffee shop HTTPS browsing better than a self-signed cert.