91–100 of 118 posts
I have decided to not use a self signed cert.
Another question: any comments on CloudFlare's auto SSL support on paid plans? $20/month does not seem too much for CDN and SSL support.
Earlier quoted context omitted.
That's the whole point: There's no way to determine "unauthenticated" SSL versus MITM SSL. Once you have that "worked out" then you've solved the issue of self-signing in the first place.
I think I have a good idea to solve this. What if a system similar to HSTS was implemented? https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security important sites (banks) could send a "don't allow self signed certs" header. Browser UI could change to educate users not to type personal information into self signed sites.
HSTS already allows self-signed certificates, if the certificated is validated out-of-band.
If you are careful when generating your certificate (that is, careful to generate a subject certificate, and not a CA certificate) and can reliably distribute your certificate to all clients you are interested in , then self-signed certificates are usually much better than the public CA system . But actually achieving the pre-distribution step is pretty hard, and basically impossible over the internet. You can achiev…
> If you are careful when generating your certificate (that is, careful to generate a subject certificate, and not a CA certificate) and can reliably distribute your certificate to all clients you are interested in, then self-signed certificates are usually much better than the public CA system. Indeed, and the blockchain (combined with a proxy like DNSChain), can be used to do this securely and for free at-scale. >…
Earlier quoted context omitted.
I think I have a good idea to solve this. What if a system similar to HSTS was implemented? https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security important sites (banks) could send a "don't allow self signed certs" header. Browser UI could change to educate users not to type personal information into self signed sites.
... Then an attacker MITMs the bank with a self-signed cert, and strips the "don't allow self-signed certs" header. Such a header would be literally useless. HSTS already allows self-signed certificates, if the certificated is validated out-of-band.
Earlier quoted context omitted.
Unauthenticated SSL does provide security against passive attackers , which is what mass surveillance in developed countries is. If the NSA ever insists on widespread MITM of connections, we have much bigger problems. I agree the UI needs to be properly worked out so that eg a bank can't be downgraded to an unauthenticated certificate.
I don't understand why they don't just use different colors for self-signed SSL connections. CA-signed: Green lockpad Self-signed: Yellow lockpad, with question mark superimposed over it Regular HTTP: Orange, no lockpad (insecure) Invalid or revoked cert: Red, "stay away" displayed within tags. The current UI that most browsers present implies that self-signed certificates are worse ("scarier") than regular HTTP, whi…
Earlier quoted context omitted.
I think I have a good idea to solve this. What if a system similar to HSTS was implemented? https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security important sites (banks) could send a "don't allow self signed certs" header. Browser UI could change to educate users not to type personal information into self signed sites.
... Then an attacker MITMs the bank with a self-signed cert, and strips the "don't allow self-signed certs" header. Such a header would be literally useless. HSTS already allows self-signed certificates, if the certificated is validated out-of-band.
In response to your previous post, the idea is that the user has to take some responsibility for their security (we can't stop them from entering their bank credentials into a friendly form on www.phish.com either), through a UI that makes it clear that the identity of the server is unauthenticated.
I posted this Ask HN earlier today. Thanks for the useful comments. I have decided to not use a self signed cert. Another question: any comments on CloudFlare's auto SSL support on paid plans? $20/month does not seem too much for CDN and SSL support.
I'm not a tech savvy person (at least around here) but I used Gandi to purchase my certificate. I paid 12 bucks and it was extremely easy to implement it. To give you an idea, I didn't even know how to enable access to my site without entering "www." in front of my URL. But getting the certificate and implementing it was so easy that I was actually surprised once my SSL was active. I was expecting to run into a coupl…
Earlier quoted context omitted.
> If you are careful when generating your certificate (that is, careful to generate a subject certificate, and not a CA certificate) and can reliably distribute your certificate to all clients you are interested in, then self-signed certificates are usually much better than the public CA system. Indeed, and the blockchain (combined with a proxy like DNSChain), can be used to do this securely and for free at-scale. >…
Could whoever down-voted that please explain why you did so?
I'm no expert on CAs but saying their certs are not securely authenticated is worrying. Seems to defeat their purpose, no? Maybe expand on that point if you can as I don't understand how it can be true.
Earlier quoted context omitted.
... Then an attacker MITMs the bank with a self-signed cert, and strips the "don't allow self-signed certs" header. Such a header would be literally useless. HSTS already allows self-signed certificates, if the certificated is validated out-of-band.
But if a site is self signed the browser could show something like "This site is not authenticated, don't enter any personal info/passwords"
I think the whole UI aspect of web transport security needs re-thinking.