Do "potential security risk" warnings when web browsing actually mean anything?

[skykiii]

The thing that makes me wonder is I often get them whenever I'm visiting sites I know are kind of old or made in a very old-school way, so I'm not sure if the reason these pop up is because the site is actually unsafe or if there's just something they expected to find that wasn't an expectation years ago.

 

[Vecr]

It's usually because the website doesn't have HTTPS or the certificates are set up wrong.

 

[Jace on ice]

Expired security certificate usually, that in an of itself doesn't mean the site is actively malicious but it does indicate whoever owns the site isn't actively maintaining it.

 

[Sultan Bin Jewstar]

It depends on the site as well.

There's a pecking order to CAs and whether they're accepted as "known".

If you're going to .mil, .gov, .{3 letter agency}, surprise- they often have certificates that aren't signed by public authorities.
Yes- they can look at your traffic.

 

[Kosher Dill]

What is the hypothetical attack that expiring SSL certificates (as opposed to revoking them if they're stolen or someone breaks a cipher) is intended to prevent?

I mean, obviously the certificate can't last forever since then dedicated glowies could literally spend decades brute-forcing your keys, but is there any other consideration in play?

 

[Vecr]

What is the hypothetical attack that expiring SSL certificates (as opposed to revoking them if they're stolen or someone breaks a cipher) is intended to prevent?

I mean, obviously the certificate can't last forever since then dedicated glowies could literally spend decades brute-forcing your keys, but is there any other consideration in play?

Revocation doesn't work, the mechanisms that were intended to implement it have mostly fallen apart.

 

[Meth Dick]

It's hit and miss. If you have to ask, it's best to not trust it at all. I bought a necklace as a gift off a website I was told was legit.
A month later, I had over 100 dollars charged to an AMC movie theatre and 80 charged to whataburger in California.
I have never been to an AMC or a Whataburger and I live 2,000 plus miles from California.
Don't trust anyone or any website

Spoiler

save for Kiwifarms that is.

 

[IamnottheNSA]

It usually doesn't mean anything malicious.
Really, the main reason you even see HTTPS everywhere these days in the first place, is that search engines will actively throttle your website in their search results if you don't have it.
This is why you see banking-grade security even on text-only webpages.

 

[Sultan Bin Jewstar]

What is the hypothetical attack that expiring SSL certificates (as opposed to revoking them if they're stolen or someone breaks a cipher) is intended to prevent?

I mean, obviously the certificate can't last forever since then dedicated glowies could literally spend decades brute-forcing your keys, but is there any other consideration in play?

It's not a hypothetical.
It's self-signing and building a trust chain on that root.
Public browsers are ignorant to these by design.
Most .mil services with these CA chains disclose this up front by saying, "you trust me. You shouldn't. I signed these and you're buying into this, idiot"

Spoiler: What it actually looks like

You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.

By using this IS (which includes any device attached to this IS), you consent to the following conditions:

· The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.

· At any time, the USG may inspect and seize data stored on this IS.

· Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG authorized purpose.

· This IS includes security measures (e.g., authentication and access controls) to protect USG interests – not for your personal benefit or privacy.

Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.

Public services that aren't using these private CAs is more align with your second point.
That's a point of legality and remaining clandestine, which I'm assuming most intelligence services would rather not volunteer to you.

 

[LifeAlert]

The thing that makes me wonder is I often get them whenever I'm visiting sites I know are kind of old or made in a very old-school way, so I'm not sure if the reason these pop up is because the site is actually unsafe or if there's just something they expected to find that wasn't an expectation years ago.

​

 

[Daddy's Angry Juice]

Only if youre a pussy

 

[Nitro!]

Just looking isn't any more a security risk than any other site. A valid certificate doesn't mean trustworthy or safe, it means that the site you requested is most likely the site that's being shown to you and data you send to it is going to the place you expect. SSL certificates are for all intents & purposes free of charge nowadays so all the shady sites are going to be trusted by your browser anyway.

The flip side of this is that HTTPS is the de-facto default now and browsers will try it first, and some of them will whine at you if it's not available but that doesn't change anything. You still have to make a judgment call to not enter your credit card number into amerzon dot com even if it has a good cert.