3 ms·

I would hardly call it secure. There have been too many failures with certificate authorities. The whole system is dependent on that weak point. Also do you ke

by anfilt 9y ago

I would hardly call it secure. There have been too many failures with certificate authorities. The whole system is dependent on that weak point. Also do you keep track of the certificates issued to every website you visit? Then if you visit the website notice the certificate has changed. Do you check if it's a legitmate change ect.. If you don't keep track of certificates how do you even know you are not being MITM. You trust the certificate authority to handle that. However, certificate authorities clearly have signed or given out bad certificates. Further, it only takes one bad certificate authority to compromise the entire system. If the browsers really cared they would make sure that all login mechanism use something like J-PAKE or a private Key. That way if certificate authority was compromised the attacker would also have to know either your password or private key. Further, not everything requires an encrypted session. It just adds overhead for no good reason. If you worried about MITM injecting a zero day. It would help if the web standards did not keep getting more and more complicated increasing the attack surface. All you need there is just a simple signed hash of the page. Some things might not even need that. --EDIT-- I went on a bit of ramble there. If we want to be Mr. Conspiracy. I would say google likes adding more and more features because it makes it harder for competing browsers to exist. Not only that let's consider HTTP 2.0. The standard does require TLS, but Firefox and Google will not talk to HTTP 2.0 web-server without TLS. The large market share of Chrome for instance makes you unable to decide to run a plain text HTTP 2.0 web-server even though TLS is optional according to the standard. Even though Chrome is not the standard as specified by the standard document. I am forced to comply with how chrome and firefox are doing things. The effectively can make their own standards since there are so few browsers. The would be my Mr. Conspiracy reason why google would want to require TLS. Becuase let's face building a secure Crypto stack the meets all the requirements for TLS is not easy. So that just increases the barrier to entry.

gruez 9y ago
>I would hardly call it secure. There have been too many failures with certificate authorities. The whole system is dependent on that weak point. >Also do you keep track of the certificates issued to every website you visit? Then if you visit the website notice the certificate has changed. Do you check if it's a legitmate change ect.. If you don't keep track of certificates how do you even know you are not being MITM. You trust the certificate authority to handle that. However, certificate authorities clearly have signed or given out bad certificates. still better than anyone being able to inject scripts when you're on an untrusted network. the requirement for a compromised CA drops the interception risk for most users to 0. >Further, not everything requires an encrypted session. It just adds overhead for no good reason. overhead of what? maybe a few hundred milliseconds on a 3g connection?
- anfilt 9y ago
  >The whole system is dependent on that weak point. A single weak point does not strike you as a bad idea? >CA drops the interception risk for most users to 0. The risk is not zero for a compromised CA. It's happened before. >overhead of what? maybe a few hundred milliseconds on a 3g connection? Sure hardware resources are cheap these days. There is more than just hardware resources though. People have to manage that system as well. Further, it makes caching impossible or hard to accomplish. Also this new feature is a clear example of how we got into this mess. We keep adding onto what was supposed just be a document markup. It's now got a turning complete language that you have to worry about. Plus a whole host of other issues. I will be honest so much the system we use these days is deeply flawed or just a hack. The fact we got to where we are is surprising. However, for instance in Firefox. I can't even go into the about:config and enable non-encrypted HTTP 2.0. Firefox is telling me they know better. I don't want software forcing decisions down my throat as a user. Sure I could in theory code up what is required to allow me to do so. (Yay open source) However, Chrome and Firefox both do not allow HTTP 2.0 without TLS. What are the chances a web-server will respond to my plain text request? So does it matter if I code up support for plain text HTTP 2.0? At least plain text HTTP I can craft an HTTP request by hand and get a response. I could do the same with plain text HTTP 2.0, but not many servers are configured to allow that or even support it.
  - Santosh83 9y ago
    Too late. The Web is well on the way to becoming the next operating system. Very soon the local OS will mostly just open web frameworks like Electron to run nearly all our apps. This way has clear benefits for s/w developers and corps. Just like there are only 3 mainstream OS vendors, there'll only be 3-4 mainstream browsers in the future. There won't be another Linus for OSes and there won't be another Mozilla for browsers. The slope has become too steep. At least not for PC and general purpose computing devices.
seanwilson 9y ago
> I would hardly call it secure. There have been too many failures with certificate authorities. The whole system is dependent on that weak point. Just because a system has flaws doesn't mean you should be using an even more flawed system like HTTP. With HTTPS, attackers can't read or modify traffic. If you really think certificate authorities are that unreliable, you can choose which certificates you trust yourself to avoid spoofing.
- anfilt 9y ago
  Of course you can keep track of Certificates. Honestly, if more people did that the better. However, my problem is the browsers are forcing choices on people that are not part of the standard. They are acting as if they know best. They are also making it harder for advance users to alter these decisions. Try to enable plain text HTTP 2.0 in Firefox? No option exists in about:config. Further, I don't see an option to disable Firefox's Secure contexts for new features. Might exist, but may need to look more.
jopsen 9y ago
The certificate transparency initiative is going to make MITM really hard.
- tyingq 9y ago
  Unless the majority of sites choose to run your javascript. Like Adsense and Analytics. Not much need for actual MITM when you are "on the page".

by anfilt 9y ago

gruez 9y ago

>I would hardly call it secure. There have been too many failures with certificate authorities. The whole system is dependent on that weak point. >Also do you keep track of the certificates issued to every website you visit? Then if you visit the website notice the certificate has changed. Do you check if it's a legitmate change ect.. If you don't keep track of certificates how do you even know you are not being MITM. You trust the certificate authority to handle that. However, certificate authorities clearly have signed or given out bad certificates. still better than anyone being able to inject scripts when you're on an untrusted network. the requirement for a compromised CA drops the interception risk for most users to 0. >Further, not everything requires an encrypted session. It just adds overhead for no good reason. overhead of what? maybe a few hundred milliseconds on a 3g connection?

anfilt 9y ago
>The whole system is dependent on that weak point. A single weak point does not strike you as a bad idea? >CA drops the interception risk for most users to 0. The risk is not zero for a compromised CA. It's happened before. >overhead of what? maybe a few hundred milliseconds on a 3g connection? Sure hardware resources are cheap these days. There is more than just hardware resources though. People have to manage that system as well. Further, it makes caching impossible or hard to accomplish. Also this new feature is a clear example of how we got into this mess. We keep adding onto what was supposed just be a document markup. It's now got a turning complete language that you have to worry about. Plus a whole host of other issues. I will be honest so much the system we use these days is deeply flawed or just a hack. The fact we got to where we are is surprising. However, for instance in Firefox. I can't even go into the about:config and enable non-encrypted HTTP 2.0. Firefox is telling me they know better. I don't want software forcing decisions down my throat as a user. Sure I could in theory code up what is required to allow me to do so. (Yay open source) However, Chrome and Firefox both do not allow HTTP 2.0 without TLS. What are the chances a web-server will respond to my plain text request? So does it matter if I code up support for plain text HTTP 2.0? At least plain text HTTP I can craft an HTTP request by hand and get a response. I could do the same with plain text HTTP 2.0, but not many servers are configured to allow that or even support it.
- Santosh83 9y ago
  Too late. The Web is well on the way to becoming the next operating system. Very soon the local OS will mostly just open web frameworks like Electron to run nearly all our apps. This way has clear benefits for s/w developers and corps. Just like there are only 3 mainstream OS vendors, there'll only be 3-4 mainstream browsers in the future. There won't be another Linus for OSes and there won't be another Mozilla for browsers. The slope has become too steep. At least not for PC and general purpose computing devices.

seanwilson 9y ago

> I would hardly call it secure. There have been too many failures with certificate authorities. The whole system is dependent on that weak point. Just because a system has flaws doesn't mean you should be using an even more flawed system like HTTP. With HTTPS, attackers can't read or modify traffic. If you really think certificate authorities are that unreliable, you can choose which certificates you trust yourself to avoid spoofing.

anfilt 9y ago
Of course you can keep track of Certificates. Honestly, if more people did that the better. However, my problem is the browsers are forcing choices on people that are not part of the standard. They are acting as if they know best. They are also making it harder for advance users to alter these decisions. Try to enable plain text HTTP 2.0 in Firefox? No option exists in about:config. Further, I don't see an option to disable Firefox's Secure contexts for new features. Might exist, but may need to look more.

jopsen 9y ago

The certificate transparency initiative is going to make MITM really hard.

tyingq 9y ago
Unless the majority of sites choose to run your javascript. Like Adsense and Analytics. Not much need for actual MITM when you are "on the page".