The modern HTTPS world has no place for old web servers

Re:The modern HTTPS world has no place for old web servers by PeterisP on Wednesday May 13, 2020 @10:41AM (#23167317)

Self-signed certs don't protect against active man in the middle attacks, but they do establish an encrypted channel that is secure against passive eavesdropping and after-the-fact decryption of network captures. So there's still some security benefit there.

[ Parent | on HN ]

Re:The modern HTTPS world has no place for old web servers by kerkeslager on Wednesday May 13, 2020 @12:34PM (#23168655)

There really isn't a real-world situation I can think of where I'd care about passive eavesdropping or after-the-fact decryption and not also care about active eavesdropping.

So I'm going to disagree. No, there is no security benefit to encryption without authentication.

[ Parent | on HN ]

Re:The modern HTTPS world has no place for old web servers by PeterisP on Wednesday May 13, 2020 @03:08PM (#23170525)

While the impact of all these things are the same, the likelihood is not.

There certainly are real world situations where the chance of active eavesdropping (which requires a targeted attack, and is risky because it can be detected) is low, so you accept that level of risk, but the ability for someone to just grab all the traffic of a large group (that just happens to include you) for a prolonged period of time undetected is much higher.

[ Parent | on HN ]

Re:The modern HTTPS world has no place for old web servers by kerkeslager on Wednesday May 13, 2020 @05:35PM (#23172102)

That's a good point. I may be wrong--I'll have to consider this a bit more.

[ Parent | on HN ]