Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I want to secure the connection between my arduino yun and my apache server. Right now I am using a simple get request in order to send information to the server. I thought to improve security by using a self signed certificate on apache and using curl -k to send information.
I wanted to ask you, do you think there are any flaws in this procedure? Is the connection secure, or an attacker can intercept the traffic and send data to the server?
As the long name of -k (--insecure) implies, that is not a good idea.
The problem with disabling the certificate validation is that it allows for easy MITM attacks, e.g. another machine can intercept the communication and read/modify requests as if it were simple http with little overhead by simply self-signing itself to be the expected host.
Instead: As long as you pin the certificate and a possible attacker cannot tamper with your trust store, your setup should be fine if you do not keep curl from verifying the certificate.
