undefined | Better HN

0 pointsxg1510y ago0 comments

With all due respect, how is that worse than HTTP? Plain HTTP can be MITMed just as well, only that on HTTP - except that no one would do that because for HTTP, plain old packet sniffing is enough to eavesdrop on a connection. Which doesn't work for self-signed HTTPS connections. And there are in fact a lot of common scenarios where it is easy for an attacker to sniff packets but harder to establish an MITM.

0 comments

Zikes10y ago

Because you'd never put your credit card into an HTTP web site, but you would on HTTPS.

Your argument about MITM being uncommon is moot because it's not impossible and is only rare because the current system is the way that it is. Changing the system would change the attackers' methods.

icebraining10y ago

Worse in the sense that you expect an HTTPS connection to be secure, while you don't (or shouldn't!) expect an HTTP connection to be.

Karunamon10y ago

Then treat a self signed HTTPS cert as equivalent to an unsecured HTTP connection and be done with it.

There's absolutely no reason that the most common failure modes (expiration, bare domain vs www., self signed) presents warnings that Something Fishy Is Going On®, when 9999/10000 times, there is not.

Smoke coming from my neighbor's yard in the summer might be a fire, but in all likelihood, they're running a barbecue grill. The SSL equivalent would be calling the fire department every time someone puts some steaks on.

icebraining10y ago

You can't treat a self-signed HTTPS cert as equivalent, because it has "https" in the URL, which people use to distinguish a safe connection from an unsafe one.

1 more reply

j / k navigate · click thread line to collapse

0 pointsxg1510y ago0 comments

0 comments

Zikes10y ago

Because you'd never put your credit card into an HTTP web site, but you would on HTTPS.

Your argument about MITM being uncommon is moot because it's not impossible and is only rare because the current system is the way that it is. Changing the system would change the attackers' methods.

icebraining10y ago

Worse in the sense that you expect an HTTPS connection to be secure, while you don't (or shouldn't!) expect an HTTP connection to be.

Karunamon10y ago

Then treat a self signed HTTPS cert as equivalent to an unsecured HTTP connection and be done with it.

icebraining10y ago

You can't treat a self-signed HTTPS cert as equivalent, because it has "https" in the URL, which people use to distinguish a safe connection from an unsafe one.

1 more reply

j / k navigate · click thread line to collapse