1 pointby basilikum2 hours ago1 comment
  • ahazred8taan hour ago
    Signed webpage schemes have been around since the 1990s. https://duckduckgo.com/?q=pgp-signed+webpages&ia=web

    Recording the TLS session doesn't work. The content is only authenticated with a symmetric session key. The content is not signed by the server's private key. Anyone can use the same session key to forge a different session with a modified webpage and new auth tags. The hash of the webpage is not signed by the private key. This is intentional. The protocol is not intended to bind the content to the private key.

    • basilikuman hour ago
      The key exchange for the symmetric session key is authenticated with the private key.