News for hackers. Stuff that matters.
Re:Launching in 2015: A Certificate Authority to Encrypt the... by SilasX on Tuesday November 18, 2014 @04:36PM (#8626510)
Encryption without verification is not useless; it protects against snooping.
Re:Launching in 2015: A Certificate Authority to Encrypt the... by nandhp on Tuesday November 18, 2014 @05:15PM (#8626728)
It doesn't prevent snooping -- you can still be MITM'd. It does however, make snooping much harder because it has to be done actively.
Re:Launching in 2015: A Certificate Authority to Encrypt the... by iancarroll on Tuesday November 18, 2014 @05:09PM (#8626698)
If you don't verify what is sent, I could easily send you a malicious web form. If you don't verify the key or cert behind the connection, anyone can claim to be x site.
Re:Launching in 2015: A Certificate Authority to Encrypt the... by Tepix on Tuesday November 18, 2014 @05:13PM (#8626722)
Stopping snooping by encrypting without strictly checking certificates the first time you connect is better than not using encryption because it stops dragnet surveillance.

Also, active attacks (like MITM) are harder to do and easier to detect than passive attacks (snooping).

Re:Launching in 2015: A Certificate Authority to Encrypt the... by iancarroll on Tuesday November 18, 2014 @05:37PM (#8626845)
That would make dragnet surveillance easier. Just MITM everything and you'll be the Trusted Source™ for all traffic.
Re:Launching in 2015: A Certificate Authority to Encrypt the... by dvdkhlng on Wednesday November 19, 2014 @04:31AM (#8629036)
No, that does not make dragnet surveillance easier. Dragnet surveillance depends on not being easily detectible. However, a SSL MITM attack is easily detected, as it changes the fingerprint of the SSL-key of the site you're talking too. By recording fingerprints and comparing them over time or for different users, or directly contacting the site's operator (using a secure communication channel, e.g. meeting him in person), the existence of a MITM is easily proven.

BTW what you call "dragnet surveillance" is better described as "Pervasive Monitoring", see also RFC7258 "Pervasive Monitoring Is an Attack" [1].

[1] http://tools.ietf.org/html/rfc7258

Re:Launching in 2015: A Certificate Authority to Encrypt the... by SilasX on Tuesday November 18, 2014 @06:05PM (#8626990)
Nobody’s suggesting that self-signed certs be treated as trusted or CA-cert equivalent, only that they not be regarded as worse than unencrypted http. In the proposals being discussed, that attack would no more of a threat than MitMs currently are against http.