3 ms·
No, the idea would be that http becomes https with a self-signed cert. It shows as 'not protected' the way http does now to the user. It only turns green or get
by api 12y ago
No, the idea would be that http becomes https with a self-signed cert. It shows as 'not protected' the way http does now to the user. It only turns green or gets the key box when it's a signed cert.
- ajanuary 12y agoVery few people are going to notice that something that used to be green now isn't. In an attempt to increase security against passive monitoring (a laudable aim) this scheme heavily neuters https' ability to increase security against MITM attacks.
- oconnore 12y agoYou are describing a downgrade attack, which is addressed by HSTS, not TLS.
- ajanuary 12y agoHSTS is designed to protect against downgrading from HTTPS to HTTP. Best I can tell, it doesn't protect against downgrading from an HTTPS with a validated certificate chain to HTTPS without a validated certificate chain. To do that, you would need something like certificate pinning. Once there is a widely deployed mechanism for detecting when a certificate has erroneously changed it would be more feasible to stop treating self-signed certificates as errors.
- oconnore 12y agoWe're talking about changing how self signed certificates are handled. You can't imagine the obvious solution of having self signed certificates not count as HSTS connections?