Hacker News Reader

> which means you may as well use TLS

Even if you don't authenticate at all, it makes it much more expensive to intercept all these connections.

And TLS lacks a way to automatically apply it to all connections.

Also I don't understand what scenario you're outlining with B.

Client <-> Evil Middlebox <-> Real Web Server

Client establishes a tcpcrypt session with what it thinks is Real Web Server but is actually Evil Middlebox replaying the request to the server and the response back to the client.

Oh so A and B are describing the same scenario, okay.

Yeah, I'm not sure what the parent was getting at separating them out since from the clients perspective they're the same. I guess they mean that getting a tcpcrypt connection on your server isn't a guarantee that there isn't a middlebox either.

They were alternative ways to prevent a MITM, but they both have solutions solved by existing TLS.

Reply on news.ycombinator.com