3 ms·
You are describing a downgrade attack, which is addressed by HSTS, not TLS.
by oconnore 11y ago
You are describing a downgrade attack, which is addressed by HSTS, not TLS.
- ajanuary 11y agoHSTS is designed to protect against downgrading from HTTPS to HTTP. Best I can tell, it doesn't protect against downgrading from an HTTPS with a validated certificate chain to HTTPS without a validated certificate chain. To do that, you would need something like certificate pinning. Once there is a widely deployed mechanism for detecting when a certificate has erroneously changed it would be more feasible to stop treating self-signed certificates as errors.
- oconnore 11y agoWe're talking about changing how self signed certificates are handled. You can't imagine the obvious solution of having self signed certificates not count as HSTS connections?