3 ms·
Very few people are going to notice that something that used to be green now isn't. In an attempt to increase security against passive monitoring (a laudable a
by ajanuary 11y ago
Very few people are going to notice that something that used to be green now isn't.
In an attempt to increase security against passive monitoring (a laudable aim) this scheme heavily neuters https' ability to increase security against MITM attacks.
- oconnore 11y agoYou are describing a downgrade attack, which is addressed by HSTS, not TLS.
- ajanuary 11y agoHSTS is designed to protect against downgrading from HTTPS to HTTP. Best I can tell, it doesn't protect against downgrading from an HTTPS with a validated certificate chain to HTTPS without a validated certificate chain. To do that, you would need something like certificate pinning. Once there is a widely deployed mechanism for detecting when a certificate has erroneously changed it would be more feasible to stop treating self-signed certificates as errors.
- oconnore 11y agoWe're talking about changing how self signed certificates are handled. You can't imagine the obvious solution of having self signed certificates not count as HSTS connections?