Curl is just the hobby

Re:Curl is just the hobby by talkin on Monday April 22, 2024 @06:34AM (#40112999)

Common misconception, but Https / TLS provides a combination of gaurantees, and the one cannot work without the other:

Encrypted transit but you might be talking with the hacker on the other end == worthless.

And with plaintext transit you cannot prove integrity during transit AND also not prove talking with the proper endpoint.

In short: Browser really is warning you that something is fishy. Don’t shoot the messenger.

[ Parent | on HN ]

Re:Curl is just the hobby by Nextgrid on Monday April 22, 2024 @07:20AM (#40113238)

I think his complaint is that HSTS also prevents the user from overriding it and Firefox is complying, which I agree is a bit annoying.

[ Parent | on HN ]

Re:Curl is just the hobby by talkin on Monday April 22, 2024 @09:22AM (#40114097)

Complaining about no overrides is complaining about not being able to ignore quite serious symptoms.

Firefox makes you fix the root problem.

[ Parent | on HN ]

Re:Curl is just the hobby by JonChesterfield on Monday April 22, 2024 @10:13AM (#40114586)

Bingo. Primarily because I don't really mind if reading this post is compromised, but at least partly because I hadn't thought through the implications of vodafone intercepting traffic.

[ Parent | on HN ]