News for hackers. Stuff that matters.

A comment on Announcing SPDY draft 2 implementation in nginx. Parent comment

Re:Announcing SPDY draft 2 implementation in nginx by blaenk on Friday June 15, 2012 @05:41PM (#4118854)
What about the first time the user connects, how would they be assured that the fingerprint really is the site's and not a man in the middle?

Honest question, myself being pretty new to cryptography.

[ Parent | on HN ]
Re:Announcing SPDY draft 2 implementation in nginx by e1ven on Friday June 15, 2012 @05:44PM (#4118869)
In theory, you could do an out-of-band comparison.

In practice, you'd generally accept that the first one you receive is valid, and then watch for deviations from there.

This is the way SSH works, for instance.

[ Parent | on HN ]