ssl - Signing / Verifying HTTPS Responses -
is possible verify response originated website?
for example, it's trivially easy forge screenshot of website - can make politician tweeted awful.
twitter's website protected https - means responses encrypted. signed?
is possible signed https response out of server can prove / verify served data?
for example, can wget
or curl
https://twitter.com/barackobama/status/645299508897714176 , back response can use prove twitter served content?
(i can't see relevant wget -s
or curl -iv --raw
)
an https response is signed. unless ask them not to, curl , wget verify certificate chain. chain must end certificate of authority computer trust. authority certify certificate valid, , wget/curl has verify certificate correspond domain name. thus, owner of private key of certificate can encrypt/decrypt data.
with "curl -v " can see more informations tls authentication.
Comments
Post a Comment