Compromise one device, extract the private key, have a "trusted for a very long ...

dcow · 2025-04-17T09:36:19 1744882579

If someone does that you’ve already been pwned. In reality you limit the CA to be ___domain scoped. I don’t know why ___domain-scoped CAs aren’t a thing.

jabiko · 2025-04-17T12:29:05 1744892945

> If someone does that you’ve already been pwned

Then why use encryption at all when your threat model for encrypted communication can't handle a malicious actor on the network?

mjmas · 2025-04-17T14:09:09 1744898949

Because there are various things in HTML and JS that require https.

(Though getting the browser to just assume http to local domains is secure like it already does for http://localhost would solve that)