Hacker News Reader

Comment by arethuza | Hacker News Reader

Why do you think browsers were "lying" when they said the certificate wasn't to be trusted? Without any kind of "trusted third party" involved there is no reason at all to trust your self signed certificate.

View on HN

OTOH, Firefox - and other browsers - make a self-signed or expired SSL certificate look extremely scary, while a totally unencrypted connection is fine. I understand the reason, but it´s still odd...

I would say that it is scarier - with a self signed cert you have someone claiming an identity without providing any independent confirmation, while providing an encrypted channel for that communication so that it "seems" safe.

Why tie identity to encryption? Just have a self signed certificate not show a lock icon, or some new icon that represents encryption but not independently confirmed identity.

Because the value of encryption is significantly reduced if you don't know who you are talking to. How do you know you're not talking to a man in the middle?

You don't. I agree that self-signed certificates are mostly useless (although stuff like the perspectives extension to Firefox might help in verification, and at least you can be sure that you are still talking to the same server), but that does not it's worse than a plain HTTP connection.

Fair question. I just checked what exactly the warning message says in IE, and it's actually a pretty fair warning message. Firefox, on the other hand, has a pretty scary "This connection is untrusted" page with a pretty confusing explanation of the alleged problem. I don't know if this still happens, but I remember a couple years ago, it was impossible to get IE or Firefox to actually save the cert or remember your preference to bypass the warning, so you would get the warning each time you had a new browser session and tried to connect to the server, no matter what.

The fact is, my real-life identity was never verified as the owner of the domain by a "trusted" third party. However, the encryption key comes from the same server serving the content, so what, really, is not to be trusted? I.e. the cert applies to "domain.com" and is being used on "domain.com". There is no risk of MITM attack, only that "domain.com" is not what you think it is.

Well, anyone can supply a key - the problem is that the client could be talking to anyone.

> There is no risk of MITM attack, only that "domain.com" is not what you think it is.

That very well could be a MITM attack

Reply on news.ycombinator.com