logoalt Hacker News

LadyCailinyesterday at 4:03 PM6 repliesview on HN

That’s not true. The encryption still works as well as it did 3 days ago, and doesn’t care if the certificate is expired.


Replies

russell_hyesterday at 4:07 PM

I think the argument would go that if people are clicking through certificate errors and you're in a position to MITM their traffic, you can just serve them a different certificate and they'll click through the error without noticing or understanding the specifics.

show 3 replies
LeifCarrotsonyesterday at 4:10 PM

It's true that the expiration doesn't mean the encryption no longer works, but if the user is under a MITM attack and is presented by their browser with a warning that the certificate is invalid, then the encryption will still work but the encrypted communication will be happening with the wrong party.

I don't trust the average user to inspect the certificate and understand the reason for the browser's rejection.

show 2 replies
hamdingersyesterday at 5:10 PM

This is an infohazard. True information that can cause harm or enable some agent to cause harm.

Telling people not to worry about expired cert warnings makes them vulnerable to a variety of attacks.

f_devdyesterday at 4:07 PM

I think they mean that a non-observant visitor cannot tell the difference between both situations

KaiserProyesterday at 6:00 PM

If you're ignoring certificate warnings, then you'll ignore mismatching domain warnings.

More over, if your org's browser setting allow you to override the warnings, thast also pretty bad for anything other than a small subset of your team.

ktm5jyesterday at 6:49 PM

That's not what man in the middle attacks are about.. it's not about the encryption, it's about verifying that you really know who you're talking to.