3 ms·

Words are hard. Anyone got an idea for a better word? Send your ideas to the security-dev mailing list (at least, I think that's the best forum...): https://gro

Words are hard. Anyone got an idea for a better word? Send your ideas to the security-dev mailing list (at least, I think that's the best forum...): https://groups.google.com/a/chromium.org/forum/#!forum/security-dev https://groups.google.com/a/chromium.org/forum/#!forum/secur...

ryandvm 9y ago
How about all it really means? "Encrypted"
- sverhagen 9y ago
  ESL, myself, but I wouldn't know if Encrypted makes a lot of sense for non-technical users?
- rocqua 9y ago
  HTTPS means more than just encryption. There is also authentication and integrity guarantees in SSL.
  - berbec 9y ago
    But the extras beyond encryption are definately not guarantees. [1] HTTPS means encrypted HTTP. Everything else is "I trust the certificate authority to provide oversight and verification." It may just be me, but I don't trust the fine, upstanding CAs we have now-a-days. 1: https://stripe.ian.sh/ https://stripe.ian.sh/
    - rocqua 9y ago
      Authenticity indeed is only guaranteed if you trust the CAs. Though it is still nice to know that getting a false cert isn't trivial. However, message integrity is a real benefit of SSL that doesn't need CAs. Consider the original article. In this case encryption doesn't matter and integrity does. Without message integrity, considering the login link has a known location and value, using bit-flips one might be able to change the login link (depending on the kind of encryption used). This message integrity is getting to be a much more important part of https. There are a lot of things that you don't want other parties able to change. Maybe even more things than you don't want them to be able to read.
  - ryandvm 9y ago
    That's my point. There is no guarantee about authenticity. Anyone can register a domain and have an SSL cert from Let's Encrypt in less than 15 minutes. The only thing that HTTPS guarantees is that you are communicating securely with the person that owns the domain. That's it.
ChrisSD 9y ago
Perhaps the reverse would be better. If a site doesn't use HTTPS, call it unsecured.
- tialaramex 9y ago
  This is expected to be the long term outcome of (at least) Google and Mozilla's current trajectory. Google specifically says (without naming a date) that their long term intent is to put a UI like a red triangle plus the phrase "Not Secure" in the URL bar for all HTTP sites on their desktop browser. This is the same treatment you get today for a site with a bogus SSL certificate and similar to the treatment HTTP sites get now in Incognito mode.

ryandvm 9y ago

How about all it really means? "Encrypted"

sverhagen 9y ago
ESL, myself, but I wouldn't know if Encrypted makes a lot of sense for non-technical users?
rocqua 9y ago
HTTPS means more than just encryption. There is also authentication and integrity guarantees in SSL.
- berbec 9y ago
  But the extras beyond encryption are definately not guarantees. [1] HTTPS means encrypted HTTP. Everything else is "I trust the certificate authority to provide oversight and verification." It may just be me, but I don't trust the fine, upstanding CAs we have now-a-days. 1: https://stripe.ian.sh/ https://stripe.ian.sh/
  - rocqua 9y ago
    Authenticity indeed is only guaranteed if you trust the CAs. Though it is still nice to know that getting a false cert isn't trivial. However, message integrity is a real benefit of SSL that doesn't need CAs. Consider the original article. In this case encryption doesn't matter and integrity does. Without message integrity, considering the login link has a known location and value, using bit-flips one might be able to change the login link (depending on the kind of encryption used). This message integrity is getting to be a much more important part of https. There are a lot of things that you don't want other parties able to change. Maybe even more things than you don't want them to be able to read.
- ryandvm 9y ago
  That's my point. There is no guarantee about authenticity. Anyone can register a domain and have an SSL cert from Let's Encrypt in less than 15 minutes. The only thing that HTTPS guarantees is that you are communicating securely with the person that owns the domain. That's it.

ChrisSD 9y ago

Perhaps the reverse would be better. If a site doesn't use HTTPS, call it unsecured.

tialaramex 9y ago
This is expected to be the long term outcome of (at least) Google and Mozilla's current trajectory. Google specifically says (without naming a date) that their long term intent is to put a UI like a red triangle plus the phrase "Not Secure" in the URL bar for all HTTP sites on their desktop browser. This is the same treatment you get today for a site with a bogus SSL certificate and similar to the treatment HTTP sites get now in Incognito mode.