Hacker News Reader

There is little point in encrypting traffic if you can't differentiate between a man in the middle and your desired endpoint.

EX: Conceder I open encrypted connection to amazone.com which pretends to be amazon.com they open an encrypted connection to amazon.com. Amazone can now pretend to be Amazon and read all my encrypted traffic.

View on HN

Users can differentiate between "amazon.com" and "amazone.com" via the browser's location bar. There's nothing stopping the owner of "amazone.com" from getting an SSL cert signed by a "trusted authority", so SSL does not help in this respect. My opinion is that conflating identity with encryption is a fundamental problem.

Some users can differentiate... assuming they notice.

The issue is in the real world building a system to handle both typos and hostel networks requires some form of authentication.

Consider someone sniffing wifi. I'm worried about eavesdropping much more often than man in the middle, and nontrusted SSL could provide that if browsers would stop freaking out and just go without a padlock.

Reply on news.ycombinator.com