4 ms·
Why is https necessary here?
by bendbro 9y ago
Why is https necessary here?
- wccrawford 9y agoIt's not, but there's a serious trend towards a security-first mindset. IMO, the idea is that if everything is secured, nothing forgets to be secured, or is left un-secure accidentally. There are also those who simply don't want people knowing what they're reading online, even if it's just programming blogs or other "harmless" stuff.
- bendbro 9y agoAgreed. You can't make a mistake when there's no decision to make.
- jacobwg 9y agoWithout https, a man in the middle could easily rewrite your website's content in different ways for different purposes, inject scripts, etc. Which at first sounds a little theoretical except that ISPs have actually done this to inject banner ads into unsecured pages (article's about a smaller ISP, but iirc Comcast has done this before as well): https://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-for-hs-ok/ https://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-...
- sillysaurus3 9y agoComcast used this technique to notify me I was about to hit my 1TB monthly cap. In that case, I was happy that they did so.
- graedus 9y agoSeems intrusive to me - wouldn't an email or text message have been a more appropriate channel to deliver that message?
- sillysaurus3 9y agoYeah, I just thought it was an interesting twist. Sometimes harmful techniques can be leveraged for good.
- dsp1234 9y agoLet's hope the water utility doesn't decide to send out a spray of brown water when it's time to remind people to leave their taps open when the temperature goes below freezing
- bendbro 9y agoI was under the impression that I wouldn't care about somebody MITMing me, but you've made me see a number of things in that vein that would bother me.