You have a moral obligation to use crypto

Re:You have a moral obligation to use crypto by dTal on Wednesday February 12, 2014 @08:51AM (#7224216)

Self-signed certificates are perfectly useful. Weaker security is still better than no security at all. For example, even unauthenticated, SSL protects you from log analysis after the fact. MITM is not the only threat model.

If it's a personal page (say, a public-facing login to your NAS) you can always check the SSL fingerprint too. You don't have to remember the whole thing, just remember a few characters and check that they're right.

[ Parent | on HN ]

Re:You have a moral obligation to use crypto by mnutt on Wednesday February 12, 2014 @07:49PM (#7228596)

Sure, but browsers are perfectly right to throw up a giant red warning that says "THIS IS NOT OK". Otherwise MITMing will become commonplace, and users won't care.

[ Parent | on HN ]

Re:You have a moral obligation to use crypto by dTal on Thursday February 13, 2014 @07:47AM (#7230986)

That's all well and good - my point was that this "self-signed certs are equivalent to no security at all" meme is both common and wrong.

[EDIT] pdkl95 said what I was trying to say more eloquently and in more depth.

[ Parent | on HN ]