News for hackers. Stuff that matters.

A comment on Wildcard Certificates Coming January 2018. Parent comment

Re:Wildcard Certificates Coming January 2018 by Jach on Thursday July 06, 2017 @11:35PM (#14715829)
Come on, it's not literally the same. It at least requires an active attacker to read your data, whereas HTTP can be read passively.
[ Parent | on HN ]
Re:Wildcard Certificates Coming January 2018 by IncRnd on Friday July 07, 2017 @02:22PM (#14720750)
You're right. It's not literally the same. However, it is effectively identical.

It is absolutely trivial for even a 5 year old to click a button and perform a downgrade attack on this type of an https:// connection. That is why accepting any self-signed certificates should be treated identically to http:// connections.

[ Parent | on HN ]