• @ttmrichter@lemmy.ml
    link
    fedilink
    33 years ago

    Self-signed certificates are too silly to bother with. Might as well go straight http if you’re going to go self-signed.

    A CA-signed cert reduces the chance of a bad actor between me and the target site. A self-signed cert opens the door to trivial MitM attacks.

    • @pinknoise@lemmy.ml
      link
      fedilink
      43 years ago

      A CA-signed cert reduces the chance of a bad actor between me and the target site.

      Because bad actors that can hijack your traffic are unable to get a fake certificate signed?!

      A self-signed cert opens the door to trivial MitM attacks.

      How would that be?

      • @ttmrichter@lemmy.ml
        link
        fedilink
        03 years ago

        Getting a fake certificate signed requires state level opposition or entities with that level of resources, and frankly if your opposition is state level, you’re fucked anyway.

        Self-signed certs let Jimmy-Joe-Bob’s Rifle Range and Real Good Hacker Script Kiddie Ring fake you out in minutes.

        • @pinknoise@lemmy.ml
          link
          fedilink
          1
          edit-2
          3 years ago

          Getting a fake certificate signed requires state level opposition or entities with that level of resources

          Yeah like I said, if they can hijack your traffic, they can easily get a fake cert signed.

          Self-signed certs let Jimmy-Joe-Bob’s Rifle Range and Real Good Hacker Script Kiddie Ring fake you out in minutes.

          How? They would have to steal the CA key and could only fake the site with the self signed cert. (At least if you don’t add it to your certificate store)

          • @ttmrichter@lemmy.ml
            link
            fedilink
            03 years ago

            The cert is self-signed. There is by definition no CA key! Anybody accessing that sight, unless they did something phenomenally stupid, is going to have to validate access by self-signed cert on each access. And that means that any MitM isn’t going to flag any alarms … because they’d be inserting themselves as a self-signed cert.