Horible public key tricks

Tip: select the the ‘tty’ mode prior to digging in.

I’ve never felt a more relaxed feeling (easy on the eyes) while reading any blog in comparison.

The linked pdf at https://tom7.org/httpv/httpv.pdf is extremely long but a great read if you enjoyed the article.

All serious attackers are man-in-the-middle attackers (usually by tricking victims into diverting their own traffic, not literally by inserting themselves into the network path). Passive-only attackers went extinct along with the backbone-connected Sun servers that were used to launch those attacks.

I don't so much care about the rest of this analysis, but you can't call an unauthenticated TLS session "secure".

>Nobody checks your private keys

You're implying that they should???

I cant get past the title spelling

> So, I've always been somewhat annoyed at SSL/TLS. It requires everyone to go through a complex "ACME" dance just to put up a public website. Worse, certificates expire every few months, so it's not a one and done thing: even with automation, maintaining a certificate requires care to ensure the ACME client always has access to DNS records or the web server.

Not actually all that long ago, people faced down the prospect of $1000+/year E.V. Verisign certs that involved faxing legal documents, phone calls, and other probing. Many jumped for joy when LetsEncrypt was finally mature enough for the mainstream. Kids these days don't know how good they've got it...

>the whole system doesn't even work

Yeah, I saw a fire hydrant leaking the other day. Time to tear out all the plumbing, the whole system doesn't even work!

[flagged]