News for hackers. Stuff that matters.
Re:Wildcard Certificates Coming January 2018 by IncRnd on Thursday July 06, 2017 @04:48PM (#14713817)
Accepting any self-signed cert that gets presented is the same as not using certs in the first place. Just use http://.

If you pre-share or pin self-signed certs that can be useful but in a different use case.

Re:Wildcard Certificates Coming January 2018 by Jach on Thursday July 06, 2017 @11:35PM (#14715829)
Come on, it's not literally the same. It at least requires an active attacker to read your data, whereas HTTP can be read passively.
Re:Wildcard Certificates Coming January 2018 by IncRnd on Friday July 07, 2017 @02:22PM (#14720750)
You're right. It's not literally the same. However, it is effectively identical.

It is absolutely trivial for even a 5 year old to click a button and perform a downgrade attack on this type of an https:// connection. That is why accepting any self-signed certificates should be treated identically to http:// connections.