Trust On First Use
Trust On First Use (TOFU) is a security model where a system automatically trusts an entity, such as a server or device, upon the first encounter, without prior verification. This trust is then persisted for future interactions, often based on the initial authentication or key exchange. It is commonly used in scenarios where establishing trust beforehand is impractical, such as in SSH connections or self-signed certificates.
Developers should learn TOFU when working with systems that require secure initial connections but lack a pre-established trust infrastructure, such as in IoT devices, peer-to-peer networks, or development environments. It simplifies deployment by avoiding complex certificate authorities or manual verification steps, though it introduces risks if the first interaction is compromised, so it's best used in controlled or low-risk settings.