Re:Replacing a Thinkpad X60 Bootflash Chip
by freehunter on Thursday May 08, 2014 @04:32PM
(#7717491)
If it's plain HTTP, serve it as such. The browser message is not misleading in any way. The site uses an untrusted certificate, and there's danger in that. Just don't put self-signed certs on internet-facing pages. It offers literally no benefit, but causes a reasonable amount of harm.
[ Parent
| on HN ]
Re:Replacing a Thinkpad X60 Bootflash Chip
by joelanders on Thursday May 08, 2014 @05:23PM
(#7717782)
The site's audience is going to be technical.
She explains how to check the SSL certificate fingerprint here:
https://blog.patternsinthevoid.net/isis.txt
Once you've whitelisted her self-signed cert, you know from then on that you're not being MITMed (for what that's worth in a blog).
Re:Replacing a Thinkpad X60 Bootflash Chip
by pantalaimon on Thursday May 08, 2014 @06:50PM
(#7718209)
If you are doing a MITM attack, you might as well change the content of isis.txt on the fly.
Re:Replacing a Thinkpad X60 Bootflash Chip
by joelanders on Thursday May 08, 2014 @07:07PM
(#7718288)
web of trust
Except you can't get there unless you go past the warning.
Re:Replacing a Thinkpad X60 Bootflash Chip
by joelanders on Thursday May 08, 2014 @06:47PM
(#7718195)
There is an awkward period (after clicking past the warning and before verifying the signed SSL certificate fingerprint) which is no more or less safe than HTTP, but which is more cumbersome and might encourage often-bad behavior in some users. After verifying that the certificate is signed by her (which requires trusting her public key--more hoops), you get some benefit.
It's difficult to weigh the cost/benefit, and nobody is denying that PKI can be awkward.
/thread?
ed: ok, i guess we might still debate the cost/benefit of getting a free cert--i don't really know.