| |||||||||||||
Scary SSL warningsScary SSL warningsPosted Apr 16, 2012 13:53 UTC (Mon) by nye (guest, #51576)In reply to: Scary SSL warnings by Jan_Zerebecki Parent article: Langley: False Start's Failure
>The user fills out a form on the page and sends it, now Request 2 is POSTed to the same URL. This time a self signed certificate is used because a MAn in the Middle attack happened. In your proposed change there is nothing available to let the Browser differentiate between a successful attack that uses a self-signed certificate and the correct certificate. That is because in the current scheme of things there is no client state about the identity of a site.
Realistically, there should be.
Even aside from how you want to treat self-signed certificates, a browser should think something's up if the certificate for a given URL changes between two requests, unless the first certificate was right on the edge of its expiration date. Keeping a record of the certificate received on the last request would be an improvement even if you continue to treat self-signed certificates the same way.
Do any browsers currently do that?
(Log in to post comments)
|
|||||||||||||