Damus
Open in Damus
Blake · 140w
“End to End Encryption” is just marketing without having significant and deliberate tampering detection mechanism. Examples include secretly swapping out a certificate/key for an identity to mid...
 The Fishcake (nostr.build) profile picture
The Fishcake (nostr.build) @The Fishcake🐶🐾
🐶🐾🫡 https://en.m.wikipedia.org/wiki/HTTP_Strict_Transport_Security

Pin the certificate. And there are many other ways to overcome mitm attacks, take a look at IPsec and various key exchange mechanisms it has🐶🐾🫡
Blake · 140w
Not talking strictly HTTPS. Even so, when have you been directly notified by an app when they updated their pinned certificate? Or even having visibility to a currently pinned certificate and it’s expiry? It’s not even the key exchange exchange security - that’s largely solved. It’s the swa...