Yeah but SSH and RDP aren't used by grandmas that get their wallets emptied by s...

jabbany · on July 30, 2023

Again, what's the risk that a first time visit to a site is going to give you a fake certificate?

OTOH SSL has done nothing for preventing phishing, since no CAs actually verify anything beyond you owning the domain.

paulmd · on July 30, 2023

Well, any time anyone might be loading up a website for the first time in a coffee shop.

Also, “remember this cert forever” (cert pinning) has been an ops disaster for a lot of sites that have tried it. So in practice “the first time” might be more like every week or every month. What the risk that a coffee shop will not serve you a malicious cert once a week?

Also if they do it and you move back to your home connection… the site is broken there because now it’s returning a different one than was pinned (by the attacker!).

apostacy · on July 31, 2023

There are plenty of ways to improve security but maintain openness.

I think a good idea might be to have TOFU and self-signed only as a fallback. If there was no initial mismatch, and then upate cert periodically.

Brian_K_White · on July 31, 2023

This amounts to a new "won't someone think of the children?"

All the little green lock icons in the world haven't put a dent in phishing or spoofing.