News for hackers. Stuff that matters.

A comment on Up to $41B in World Bank climate finance unaccounted for, Oxfam finds. Parent comment

Re:Up to $41B in World Bank climate finance unaccounted for,... by BenjiWiebe on Sunday October 27, 2024 @03:56PM (#41965155)
An expired certificate still encrypts your traffic. You might have to change settings or click through a scary warning in your browser, but other than that a certificate doesn't magically quit working as soon as it expires. The expiration date is arbitrary.
[ Parent | on HN ]
Re:Up to $41B in World Bank climate finance unaccounted for,... by starttoaster on Sunday October 27, 2024 @04:19PM (#41965336)
You are correct, I had to do a bit of research. Because Chrome even explicitly states that traffic to a site with an expired certificate is unencrypted. But I guess that's mostly to scare you, because the truth is that it just opens you up to potential MitM attacks and other similar issues with regular ole HTTP, but traffic between you and an unverifiable identity is at least TLS encrypted.
[ Parent | on HN ]
Re:Up to $41B in World Bank climate finance unaccounted for,... by yarg on Sunday October 27, 2024 @04:44PM (#41965527)
> Because Chrome even explicitly states that traffic to a site with an expired certificate is unencrypted.

If that's the case, then Google's condescension is doing a disservice to its users.

[ Parent | on HN ]
Re:Up to $41B in World Bank climate finance unaccounted for,... by BenjiWiebe on Tuesday October 29, 2024 @02:19AM (#41979964)
(Tested with Chromium, at https://expired.badssl.com) It says "Not Secure" on the left side of the address bar. It says "Privacy error" as the tab title. And then the body of the page:

<bold>Your connection is not private</bold> Attackers might be trying to steal your information from expired.badssl.com (for example, passwords, messages, or credit cards). Learn more about this warning net::ERR_CERT_DATE_INVALID

[ Parent | on HN ]