4 ms·
Using https (encryption) always is not just about keeping content secret. It is also about ensuring content was not tampered with and ensuring you got the conte
by jjuhl 11y ago
Using https (encryption) always is not just about keeping content secret. It is also about ensuring content was not tampered with and ensuring you got the content from the source you expect.
In addition to that there's the whole debate about encrypting everything because otherwise if only sensitive stuff is using encryption it's that much easier to pinpoint sensitive stuff for metadata analysis etc. Much better if everything is just encrypted by default.
- yeukhon 11y agoTrue (plus no more mixed content warning) but not exactly 100% of the picture, warrants a footnote here. Unless you actually know which source you expect to get from, you can't tell if https://evil.com/evil.js https://evil.com/evil.js is intended over https://legit.com/legit.js https://legit.com/legit.js. In the end, they are over https, and authenticated. From a user point of view, I am not sure how we can actually defend that, but as an author of a page, you can try to enforce expectation with various HTTP headers (CSP, suborigin integrity). Authentication is one thing, but determining the integrity is another.