3 ms·

Or maybe Google and Mozilla actually want to make the web more secure? Not everything has to be a conspiracy.

anfilt 9y ago
I would hardly call it secure. There have been too many failures with certificate authorities. The whole system is dependent on that weak point. Also do you keep track of the certificates issued to every website you visit? Then if you visit the website notice the certificate has changed. Do you check if it's a legitmate change ect.. If you don't keep track of certificates how do you even know you are not being MITM. You trust the certificate authority to handle that. However, certificate authorities clearly have signed or given out bad certificates. Further, it only takes one bad certificate authority to compromise the entire system. If the browsers really cared they would make sure that all login mechanism use something like J-PAKE or a private Key. That way if certificate authority was compromised the attacker would also have to know either your password or private key. Further, not everything requires an encrypted session. It just adds overhead for no good reason. If you worried about MITM injecting a zero day. It would help if the web standards did not keep getting more and more complicated increasing the attack surface. All you need there is just a simple signed hash of the page. Some things might not even need that. --EDIT-- I went on a bit of ramble there. If we want to be Mr. Conspiracy. I would say google likes adding more and more features because it makes it harder for competing browsers to exist. Not only that let's consider HTTP 2.0. The standard does require TLS, but Firefox and Google will not talk to HTTP 2.0 web-server without TLS. The large market share of Chrome for instance makes you unable to decide to run a plain text HTTP 2.0 web-server even though TLS is optional according to the standard. Even though Chrome is not the standard as specified by the standard document. I am forced to comply with how chrome and firefox are doing things. The effectively can make their own standards since there are so few browsers. The would be my Mr. Conspiracy reason why google would want to require TLS. Becuase let's face building a secure Crypto stack the meets all the requirements for TLS is not easy. So that just increases the barrier to entry.
- gruez 9y ago
  >I would hardly call it secure. There have been too many failures with certificate authorities. The whole system is dependent on that weak point. >Also do you keep track of the certificates issued to every website you visit? Then if you visit the website notice the certificate has changed. Do you check if it's a legitmate change ect.. If you don't keep track of certificates how do you even know you are not being MITM. You trust the certificate authority to handle that. However, certificate authorities clearly have signed or given out bad certificates. still better than anyone being able to inject scripts when you're on an untrusted network. the requirement for a compromised CA drops the interception risk for most users to 0. >Further, not everything requires an encrypted session. It just adds overhead for no good reason. overhead of what? maybe a few hundred milliseconds on a 3g connection?
  - anfilt 9y ago
    >The whole system is dependent on that weak point. A single weak point does not strike you as a bad idea? >CA drops the interception risk for most users to 0. The risk is not zero for a compromised CA. It's happened before. >overhead of what? maybe a few hundred milliseconds on a 3g connection? Sure hardware resources are cheap these days. There is more than just hardware resources though. People have to manage that system as well. Further, it makes caching impossible or hard to accomplish. Also this new feature is a clear example of how we got into this mess. We keep adding onto what was supposed just be a document markup. It's now got a turning complete language that you have to worry about. Plus a whole host of other issues. I will be honest so much the system we use these days is deeply flawed or just a hack. The fact we got to where we are is surprising. However, for instance in Firefox. I can't even go into the about:config and enable non-encrypted HTTP 2.0. Firefox is telling me they know better. I don't want software forcing decisions down my throat as a user. Sure I could in theory code up what is required to allow me to do so. (Yay open source) However, Chrome and Firefox both do not allow HTTP 2.0 without TLS. What are the chances a web-server will respond to my plain text request? So does it matter if I code up support for plain text HTTP 2.0? At least plain text HTTP I can craft an HTTP request by hand and get a response. I could do the same with plain text HTTP 2.0, but not many servers are configured to allow that or even support it.
tyingq 9y ago
It's not a conspiracy to suggest Google wants to know what sites/pages we are all visiting. And that being the only entity with a way to do that broadly helps them. No need to do actual MITM when a majority of sites are running your JS via Adsense or Analytics. Https only shuts down the ability for ISPs and mobile carriers to do that. And many of them were doing so. I suspect that backbone providers were doing it as well. Good thing to shut down, sure, but it's also good for G.

I would hardly call it secure. There have been too many failures with certificate authorities. The whole system is dependent on that weak point. Also do you keep track of the certificates issued to every website you visit? Then if you visit the website notice the certificate has changed. Do you check if it's a legitmate change ect.. If you don't keep track of certificates how do you even know you are not being MITM. You trust the certificate authority to handle that. However, certificate authorities clearly have signed or given out bad certificates. Further, it only takes one bad certificate authority to compromise the entire system. If the browsers really cared they would make sure that all login mechanism use something like J-PAKE or a private Key. That way if certificate authority was compromised the attacker would also have to know either your password or private key. Further, not everything requires an encrypted session. It just adds overhead for no good reason. If you worried about MITM injecting a zero day. It would help if the web standards did not keep getting more and more complicated increasing the attack surface. All you need there is just a simple signed hash of the page. Some things might not even need that. --EDIT-- I went on a bit of ramble there. If we want to be Mr. Conspiracy. I would say google likes adding more and more features because it makes it harder for competing browsers to exist. Not only that let's consider HTTP 2.0. The standard does require TLS, but Firefox and Google will not talk to HTTP 2.0 web-server without TLS. The large market share of Chrome for instance makes you unable to decide to run a plain text HTTP 2.0 web-server even though TLS is optional according to the standard. Even though Chrome is not the standard as specified by the standard document. I am forced to comply with how chrome and firefox are doing things. The effectively can make their own standards since there are so few browsers. The would be my Mr. Conspiracy reason why google would want to require TLS. Becuase let's face building a secure Crypto stack the meets all the requirements for TLS is not easy. So that just increases the barrier to entry.

gruez 9y ago
>I would hardly call it secure. There have been too many failures with certificate authorities. The whole system is dependent on that weak point. >Also do you keep track of the certificates issued to every website you visit? Then if you visit the website notice the certificate has changed. Do you check if it's a legitmate change ect.. If you don't keep track of certificates how do you even know you are not being MITM. You trust the certificate authority to handle that. However, certificate authorities clearly have signed or given out bad certificates. still better than anyone being able to inject scripts when you're on an untrusted network. the requirement for a compromised CA drops the interception risk for most users to 0. >Further, not everything requires an encrypted session. It just adds overhead for no good reason. overhead of what? maybe a few hundred milliseconds on a 3g connection?
- anfilt 9y ago
  >The whole system is dependent on that weak point. A single weak point does not strike you as a bad idea? >CA drops the interception risk for most users to 0. The risk is not zero for a compromised CA. It's happened before. >overhead of what? maybe a few hundred milliseconds on a 3g connection? Sure hardware resources are cheap these days. There is more than just hardware resources though. People have to manage that system as well. Further, it makes caching impossible or hard to accomplish. Also this new feature is a clear example of how we got into this mess. We keep adding onto what was supposed just be a document markup. It's now got a turning complete language that you have to worry about. Plus a whole host of other issues. I will be honest so much the system we use these days is deeply flawed or just a hack. The fact we got to where we are is surprising. However, for instance in Firefox. I can't even go into the about:config and enable non-encrypted HTTP 2.0. Firefox is telling me they know better. I don't want software forcing decisions down my throat as a user. Sure I could in theory code up what is required to allow me to do so. (Yay open source) However, Chrome and Firefox both do not allow HTTP 2.0 without TLS. What are the chances a web-server will respond to my plain text request? So does it matter if I code up support for plain text HTTP 2.0? At least plain text HTTP I can craft an HTTP request by hand and get a response. I could do the same with plain text HTTP 2.0, but not many servers are configured to allow that or even support it.

tyingq 9y ago

It's not a conspiracy to suggest Google wants to know what sites/pages we are all visiting. And that being the only entity with a way to do that broadly helps them. No need to do actual MITM when a majority of sites are running your JS via Adsense or Analytics. Https only shuts down the ability for ISPs and mobile carriers to do that. And many of them were doing so. I suspect that backbone providers were doing it as well. Good thing to shut down, sure, but it's also good for G.