News for hackers. Stuff that matters.

A comment on Chromium and Mozilla to enforce 1 year validity for TLS certificates. Parent comment

Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by mkl on Sunday June 28, 2020 @04:38PM (#23671851)
> SSH can do encryption without requiring identity verification. It handles it by asking "Do you want to trust this new server?".

The problem is to figure out whether to trust the server you need to get its fingerprint through another channel. Is there an HTTPS equivalent of that?

[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by lukeschlather on Sunday June 28, 2020 @05:06PM (#23672054)
You don't need to get the fingerprint through another channel. Getting the fingerprint through another channel prevents some classes of attacks. Blindly storing the first fingerprint offered also prevents a variety of attacks.
[ Parent | on HN ]