Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

In practice, 99% of use cases do not have to worry about a MitM attack that is successful 100% of the time. The probability of a MitM attack remaining successful for all your interactions (and that's what would be required for it to go undetected) drops exponentially under a lot of (though admittedly not all) attack scenarios.

This is exactly the reasoning behind proposals such as TACK.

Edited to add: Keep in mind that external verification basically never happens, as much as cryptographers want it to happen. In the real world, you have a choice between no verification at all and a pinning-based verification which is weaker than the theoretical ideal, but makes MitM'ing significantly harder and much more likely to be detected for everybody at no user interface cost.



Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: