The protection offered by TLS in a TOFU scheme

[Björn Wärmedal]

There's been some questions on the mailing list about what sort of
protection a TOFU scheme in certificates offers. I've written about
this on my gemlog a couple of times, and several people have told me
that the posts are a good introduction to the subject. Therefore I
feel confident about posting links here :)

The first one is a short and somewhat sloppy introduction to
certificate security in general. The second is a more thorough guide
to TOFU as a validation scheme.

In general, TLS without any validation at all offers no significant
protection. However (and this is worth noting) it does protect data in
transit from dragnet surveillance. A simple sniff of network traffic
will not reveal the paths you visit on a server, or the query strings
you send. That's always something. Any sort of validation at all
offers more security on top of that. TOFU is not perfect, but it's a
lot better than no validation.

gemini://warmedal.se/~bjorn/posts/certificate-security.gmi

gemini://warmedal.se/~bjorn/posts/your-gemini-browser-and-server-are-probably-doing-certificates-wrong.gmi

Cheers,
ew0k