What about the first time the user connects, how would they be assured that the fingerprint really is the site's and not a man in the middle?
Honest question, myself being pretty new to cryptography.
Honest question, myself being pretty new to cryptography.
In practice, you'd generally accept that the first one you receive is valid, and then watch for deviations from there.
This is the way SSH works, for instance.