Re:You have a moral obligation to use crypto
by mnutt on Tuesday February 11, 2014 @08:22PM
(#7221871)
I was familiar with the reasons why using self-signed SSL didn't buy you anything, but hadn't really put together how it would completely weaken the whole ecosystem until now. "Oh, that's just Verizon MITMing me like always..."
[ Parent
| on HN ]
Re:You have a moral obligation to use crypto
by dTal on Wednesday February 12, 2014 @08:51AM
(#7224216)
Self-signed certificates are perfectly useful. Weaker security is still better than no security at all. For example, even unauthenticated, SSL protects you from log analysis after the fact. MITM is not the only threat model.
If it's a personal page (say, a public-facing login to your NAS) you can always check the SSL fingerprint too. You don't have to remember the whole thing, just remember a few characters and check that they're right.
Re:You have a moral obligation to use crypto
by mnutt on Wednesday February 12, 2014 @07:49PM
(#7228596)
Sure, but browsers are perfectly right to throw up a giant red warning that says "THIS IS NOT OK". Otherwise MITMing will become commonplace, and users won't care.
Re:You have a moral obligation to use crypto
by dTal on Thursday February 13, 2014 @07:47AM
(#7230986)
That's all well and good - my point was that this "self-signed certs are equivalent to no security at all" meme is both common and wrong.
[EDIT] pdkl95 said what I was trying to say more eloquently and in more depth.