Re: Network security manager

[Lars Magne Ingebrigtsen]

Thinking about it a bit more, I see one security implication when
downloading images in eww without verifying the certificates.

Let's say you've logged in to https://example.com so you have a login
cookie.  Somebody could man-in-the-middle you between when you've loaded
the HTML and when you're loading the images from https://example.com,
and then you will be sending your login cookie to that man who sits
there in the middle.

This is the sort of scenario that Professional Security Professionals
love.

So...  failing and leaving a "broken image" icon in the buffer is
probably the safe thing to do.  (It's what all other browsers do.)

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no