castorio

trust in protonmail is destroyed: http://www.nzz.ch/mehr/digital/protonmail-thomas-roth-javasc...

similar approach: https://8ack.de/honeypot/

check the Country-Page

you lost me at 'npm install -g ...'

- boring - stupid - false - linkbait - spam

yes, i know, but accoring to the blogpost below it should be no problem for newser browsers when using tls 1.2, but might e usefull to keep compatibility with very legacy clients, no? disclaimer: i'm not a crypto-guru, the ciphers used are copypasta'd from https://www.ssllabs.com/projects/best-practices/.

https://community.qualys.com/blogs/securitylabs/2013/03/19/r...

an updated version is available, now with nginx+libressl statically linked

you might be right: i did a new test with nginx+libressl static and the results are very similar: https://www.mare-system.de/static/bimages/nginx-libressl/per...

no, they arent a solution, but they arent a problem either. think ssh/know_hosts - file.

convergence might have been an interesting approach, but i did not heard much of it lately http://convergence.io/

using the CA-model in its current way doesnt protect you from MITM either. diginotar anyone? http://en.wikipedia.org/wiki/DigiNotar

what do you mean by "Fast"?

from what i've learned with webservers it depends on implementation: cipher-suites, keep-alive, session-ticket-reusage etc. this pic shows the perfomance for a webserver w/ different cipher-suites: https://8ack.de/static/bimages/ssl_perftest_r1.jpg

speaking of webservers, if you use the usual performance-tweaks you wouldnt see a big performance-drawback from userperspective (YMMV)

self-signed is as good as CA-based from a security-POV. it's just that the browsers complain.

sure, there exists a project already with a local copy of included sites; it would be ease (i think) to modify this project to download and evaluate a current db-copy on browser-start

https://chrome.google.com/webstore/detail/plain-text-offende...