I'd like to get rid of pulseaudio but ... (Gene Heskett)

[Bruno Wolff III]

On Sun, May 31, 2009 at 13:26:17 -0500,
  Chris Adams <cmadams at hiwaay.net> wrote:
> Once upon a time, Kevin Kofler <kevin.kofler at chello.at> said:
> > Most likely it's just a self-signed SSL certificate. Very common, and
> > Firefox stupidly throws a fit over it (which is dumb because it encourages
> > sites to just use unencrypted HTTP instead, which is even less secure, yet
> > gets through with no warning). Just OK the certificate.
> 
> HTTPS with an unknown self-signed cert is barely any more secure than
> unencrypted HTTP, since a man-in-the-middle attack could just be
> replacing the cert and decrypting all communications.

No it is a much harder attack than snooping. To do man in the middle you need
to be able to take packets out of the stream and redirect them. This needs to
be done in real time and if you guess wrong about whether the other end knows
what the certificate is, people are going to notice you doing it.

> However, the reason to "throw a fit" is that end-users have been trained
> that "HTTPS == secure".  They know that HTTP is not secure, but they
> don't know the details of how SSL/TLS work to know that "HTTPS with
> unknown cert != secure".

And be sure to note that certificate signed by RSA, Thawte or whoever doesn't
equate to secure either. Unless you have verified the end certificate
yourself you don't know that the organization on the other end is who you
really mean to be talking to.