News for hackers. Stuff that matters.
Re:Still Why No HTTPS? by zozbot234 on Wednesday December 18, 2019 @06:12AM (#21823776)
A sophisticated attacker might know that you were going to connect to a self-signed site, though. Interestingly though, private DNS (DoH, etc.) might help further shroud this fact from the attacker.

All in all, I'd say that the browser should still throw up a full-page warning because of the implications of TOFU, but it can be one where the "continue to site" option is clearly shown even to a naïve user, and not hidden behind a spoiler.

Re:Still Why No HTTPS? by namibj on Wednesday December 18, 2019 @11:24AM (#21826425)
Then maybe fall back to DANE and thus restrict this to zones signed with more than 1024bit RSA?