Standing on our own two feet

Re:Standing on our own two feet by laughinghan on Friday November 06, 2020 @03:04PM (#25010637)

The man-in-the-middle can self-sign their own certs and present it to you as the site's own self-signed cert. Unless you have some way to verify self-signed certs out-of-band, they're useless.

[ Parent | on HN ]

Re:Standing on our own two feet by josephg on Friday November 06, 2020 @05:04PM (#25011604)

They’re not useless. They stop passive adversaries, like the Australian government. They just don’t stop active adversaries.

Browser security warnings imply https > http > self signed https. The correct order of should be https > self signed https > http.

[ Parent | on HN ]

Re:Standing on our own two feet by throwaway525142 on Friday November 06, 2020 @09:24PM (#25012829)

We're getting there, HTTP is going to be marked as insecure in the future as well. It's just the massive amount of HTTP sites that couldn't get marked as insecure before, due to the then resulting warning fatigue in users.

[ Parent | on HN ]

Re:Standing on our own two feet by zhenyavinogrdov on Saturday November 07, 2020 @12:09AM (#25013326)

Allowing untrusted certificates for https, and showing just a warning for them, would make it impossible for websites to ensure that their traffic is not intercepted

[ Parent | on HN ]

Re:Standing on our own two feet by laughinghan on Friday November 06, 2020 @08:28PM (#25012603)

Interesting point. BTW I love your blog and your work on ShareJS :)

[ Parent | on HN ]