Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

What's the point ? This effectively makes the whole encryption worthless, might as well serve your site in plain HTTP


The visitor cannot be sure that he really is connected to git.cypherpunks.ru. But doesn't encryption work anyway?


Encryption is active with a host you don't know. It's TOFU, which is OK if you can verify the identity through persistent uses (ie with SSH you'll have connections with the same server over a long period of time, or with IM you'll talk to those people over a long period of time). In the case of HTTP you'll only get the content now and potentially not visit the site anymore for a long time, especially if it's a personal site.

A few years ago self-signed certificates made some sense, today with Let's Encrypt there is absolutely no good reason to continue doing this on the open web




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: