People are more likely, not less, to smell something fishy if they see a random string of digits when they expect the name of a site they trust.
If this is the only argument against certificates for IP addresses, I think we’re good.
People are more likely, not less, to smell something fishy if they see a random string of digits when they expect the name of a site they trust.
If this is the only argument against certificates for IP addresses, I think we’re good.
Experienced users like you and I know to hover over links, check certificate info, or inspect the address bar. But many users don’t do that — or worse, they click links without verifying anything. According to the Verizon DBIR and other phishing studies, this is still one of the top attack vectors today.
Also, I don’t think the article was arguing against IP certs outright — just highlighting that, like with any new capability, there's potential for abuse that the broader public (and infosec community) should be aware of.
A space for Bonfire maintainers and contributors to communicate