← Back to context

Comment by z9znz

3 years ago

MITM could change what the client receives, right?

Yes. But if you worry about being a target for MITM attacks, https alone does not fix that problem. You need some reliable verification mechanism that is hard to fool. The current CA system or "trust on first use" are only partial, imperfect mechanisms.