News for hackers. Stuff that matters.

A comment on Chromium and Mozilla to enforce 1 year validity for TLS certificates. Parent comment

Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by filmor on Sunday June 28, 2020 @03:51PM (#23671540)
HTTP traffic would be unencrypted, so everyone (esp. on Wifi) could record passwords etc. flying around. With HTTPS, you at least need to MITM the connection to do that. If you establish trust in some other way (cert ID printed on the device?), the connection is secure.
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by riskable on Sunday June 28, 2020 @04:28PM (#23671783)
Not just intercept: Using HTTPS prevents messing with the connection in-flight. So an attacker won't be able to inject their own payload into that web page you just requested.
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by CountSessine on Sunday June 28, 2020 @06:26PM (#23672571)
Except you’re using garbage certificates so anyone could MITM you and inject whatever they like.
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by bavell on Sunday June 28, 2020 @07:34PM (#23672892)
In what way are self-signed certs garbage? They're essentially the same as ssh certs.
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by samus on Sunday June 28, 2020 @10:50PM (#23673916)
That's a separate kind of attack, not intrinsic to the protocol. If the keypair got leaked or a CA misbehaves and issues multiple certificates that can be used for a host, then yes, it can happen.
[ Parent | on HN ]