News for hackers. Stuff that matters.

A comment on Signing .jars is not worth the effort. Parent comment

Re:Signing .jars is not worth the effort by ptx on Friday July 31, 2020 @02:21PM (#24011850)
Ah, good point, thanks. I misread the first sentence of the comment I was responding to as being about the server's public key, so I was assuming password authentication.

With pubkey authentication (or rarely-seen-in-practice authentication with client SSL certs on the web) the attacker couldn't impersonate the client.

[ Parent | on HN ]
Re:Signing .jars is not worth the effort by MaxBarraclough on Friday July 31, 2020 @03:09PM (#24012613)
Right, but it's still pretty disastrous if the attacker succeeds in tricking you into connecting to their machine, so you still need to verify the server's fingerprint.
[ Parent | on HN ]