3 ms·
The situation you describe is a great use case for well-implemented TLS interception. There is absolutely no need to degrade security and privacy for everyone e
by jcrawfordor 10y ago
The situation you describe is a great use case for well-implemented TLS interception. There is absolutely no need to degrade security and privacy for everyone else just to cover this case of individuals in a more restrictive environment.
- 3pt14159 10y agoThe question was "why not HTTPS everywhere?" which I've answered. Your rebuttal is "then don't use HTTPS everywhere!" then ok, we're in agreement. Your answer could have also been "doesn't matter, still use HTTPS everywhere!" which I think is also a fine answer if we're also ok with taking certain computers off of the internet, like say the computers that children use at school[1] or computers in charge of medical data, but our choice is one of three things: 1. Give up privacy because our data is easy to leak out through HTTPS traffic, so we'll admit defeat and let our healthcare records leak because we can't MITM the traffic. 2. Give up privacy because we have methods of MITM attacking, including for both good and evil uses. 3. Give up efficiency by removing computers from the internet / other large networks. Personally I think the long run is #3 but I've underestimated humanity's laziness many times. [1] I'm actually 100% ok with this until a certain age, they really don't need more than messaging, typing classes, a math program or three, and Wikipedia.
- jcrawfordor 10y agoTLS interception does not equate to not using HTTPS. Loading a trusted MITM certificate into the trust stores of computers an organization manages is a perfectly valid way to use HTTPS that does not need to compromise the security of HTTPS, even if many products have implemented it poorly.