4 ms·

Well, ok, but what about the websites that don't have ads or logins or other personal information?

by drdeca 9y ago

UncleMeat 9y ago
Integrity. HTTPS prevents scripts from being inserted into a page, which is still a problem even for static content that includes no forms.
Klathmon 9y ago
I think you misunderstand. An ad-free website served over HTTP can (and does) have ads injected into it by someone along the way. And not just ads, but malware as well. And privacy of information going from your browser to the internet is only half of the equation. What about privacy about what you are viewing? I don't want every single router between my computer and the server knowing the full contents of the pages I'm choosing to view, or building advertising profiles on my habits, or even knowing what device type, browser, OS, and more I'm using.
- josteink 9y ago
  Only if you use a shitty ISP which tries to MITM you. So don’t use a shitty ISP that tries to MITM you. Problem solved. How is that even controversial?
  - Klathmon 9y ago
    But it's not only if you use a shitty ISP. It's if any hop between you and the server is being shitty. And only 1 or 2 of those can you control as the user.
  - pfg 9y ago
    Users often have very little choice when it comes to their ISP. Regional ISP monopolies are very much a thing in many countries.
  - shakna 9y ago
    Having spent four months in a hospital, it isn't just "ISPs" who are the problem. Rather than the hospital supplying any kind of proper authentication, they MITM the first connection to their WiFi, and logged your IP address as your user. They also required you refresh that connection every half hour or so. There are a lot of people doing things in really bad ways. We can't fix all of them, and often we don't have a choice about interacting with them.
    - IncRnd 9y ago
      Yep. That's why the name for any one of these is "captive portal".
- drdeca 9y ago
  Ah, ok. Would a self-signed (I'm not sure this is the right terminology) cert be sufficient for this? That way if someone MITM'd you, you would see that the cert changed, right? But I guess if the path you use to the website is always the same, then if they MITM'd you the first time you accessed it, you wouldn't be able to tell? Hmm, I guess that probably isn't enough then. Is there really no good way to serve public information from a website that doesn't require periodically updating one's cert, and without risking MITM'ers changing the content? I guess if the client already has the hash of the content, but that isn't very convenient. Huh. I guess example.com needs https then?
  - shakna 9y ago
    They already serve example.com as both https and http. Try it: https://example.com/ https://example.com/ They don't use HSTS to force it, because example.com isn't meant to anything but an example.
  - ams6110 9y ago
    > Would a self-signed (I'm not sure this is the right terminology) cert be sufficient for this? Yes, but browsers make that MUCH more scary than surfing insecure (not https) sites.
    - charliesome 9y ago
      Self-signed certificates are trivially MITMable. In the absence of cert pinning (like SSH does), they offer no security.
      - ams6110 9y ago
        The chicken and egg problem with self-signed certs is not solved by Lets Encrypt. It's simply a matter of who do you trust. I can publish my personal CA certificate and ask you to trust it. This is hardly different than how I prove myself to Lets Encrypt.
        tialaramex 9y ago
- gsich 9y ago
  True. But why should the website owner do something about it? It's a crappy network the user is using. The same crappy network could strip https and then inject ads.
  - Klathmon 9y ago
    No, a properly setup site cannot have it's HTTPS stripped, and even if it could it is the browsers job to warn the user that they site they are on is insecure regardless of why it is that way.
    - gsich 9y ago
      https stripped or doesn't work could be achieved. Problem is that browser warnings are sometimes false. Self signed certificates are not unsecure, the underlying encryption is still the same. The "unsecure" only applies to the CA, but that is not clear in the warning.
      - Klathmon 9y ago
        >Problem is that browser warnings are sometimes false. Self signed certificates are not unsafe, the underlying encryption is still the same. Browser warnings aren't false, you're reading of them is false. Read around on badssl.com [0]. The self-signed warnings in chrome say: >Attackers might be trying to steal your information from self-signed.badssl.com (for example, passwords, messages, or credit cards). And when you click advanced chrome says: >This server could not prove that it is self-signed.badssl.com; its security certificate is not trusted by your computer's operating system. This may be caused by a misconfiguration or an attacker intercepting your connection. It says nothing about the encryption being bad, I don't know where you got that from. What it does say is that Chrome has no way to validate that the site you are going to is actually the site in the address bar. Encryption is pointless if anyone and everyone knows the password (oversimplified, but you get the point). Encryption without Authentication is as secure as normal HTTP. [0] https://badssl.com/ https://badssl.com/
        9y ago

Well, ok, but what about the websites that don't have ads or logins or other personal information?

by drdeca 9y ago

Well, ok, but what about the websites that don't have ads or logins or other personal information?

Integrity. HTTPS prevents scripts from being inserted into a page, which is still a problem even for static content that includes no forms.

Klathmon 9y ago

I think you misunderstand. An ad-free website served over HTTP can (and does) have ads injected into it by someone along the way. And not just ads, but malware as well. And privacy of information going from your browser to the internet is only half of the equation. What about privacy about what you are viewing? I don't want every single router between my computer and the server knowing the full contents of the pages I'm choosing to view, or building advertising profiles on my habits, or even knowing what device type, browser, OS, and more I'm using.

josteink 9y ago
Only if you use a shitty ISP which tries to MITM you. So don’t use a shitty ISP that tries to MITM you. Problem solved. How is that even controversial?
- Klathmon 9y ago
  But it's not only if you use a shitty ISP. It's if any hop between you and the server is being shitty. And only 1 or 2 of those can you control as the user.
- pfg 9y ago
  Users often have very little choice when it comes to their ISP. Regional ISP monopolies are very much a thing in many countries.
- shakna 9y ago
  Having spent four months in a hospital, it isn't just "ISPs" who are the problem. Rather than the hospital supplying any kind of proper authentication, they MITM the first connection to their WiFi, and logged your IP address as your user. They also required you refresh that connection every half hour or so. There are a lot of people doing things in really bad ways. We can't fix all of them, and often we don't have a choice about interacting with them.
  - IncRnd 9y ago
    Yep. That's why the name for any one of these is "captive portal".
drdeca 9y ago
Ah, ok. Would a self-signed (I'm not sure this is the right terminology) cert be sufficient for this? That way if someone MITM'd you, you would see that the cert changed, right? But I guess if the path you use to the website is always the same, then if they MITM'd you the first time you accessed it, you wouldn't be able to tell? Hmm, I guess that probably isn't enough then. Is there really no good way to serve public information from a website that doesn't require periodically updating one's cert, and without risking MITM'ers changing the content? I guess if the client already has the hash of the content, but that isn't very convenient. Huh. I guess example.com needs https then?
- shakna 9y ago
  They already serve example.com as both https and http. Try it: https://example.com/ https://example.com/ They don't use HSTS to force it, because example.com isn't meant to anything but an example.
- ams6110 9y ago
  > Would a self-signed (I'm not sure this is the right terminology) cert be sufficient for this? Yes, but browsers make that MUCH more scary than surfing insecure (not https) sites.
  - charliesome 9y ago
    Self-signed certificates are trivially MITMable. In the absence of cert pinning (like SSH does), they offer no security.
    - ams6110 9y ago
      The chicken and egg problem with self-signed certs is not solved by Lets Encrypt. It's simply a matter of who do you trust. I can publish my personal CA certificate and ask you to trust it. This is hardly different than how I prove myself to Lets Encrypt.
      - tialaramex 9y ago
gsich 9y ago
True. But why should the website owner do something about it? It's a crappy network the user is using. The same crappy network could strip https and then inject ads.
- Klathmon 9y ago
  No, a properly setup site cannot have it's HTTPS stripped, and even if it could it is the browsers job to warn the user that they site they are on is insecure regardless of why it is that way.
  - gsich 9y ago
    https stripped or doesn't work could be achieved. Problem is that browser warnings are sometimes false. Self signed certificates are not unsecure, the underlying encryption is still the same. The "unsecure" only applies to the CA, but that is not clear in the warning.
    - Klathmon 9y ago
      >Problem is that browser warnings are sometimes false. Self signed certificates are not unsafe, the underlying encryption is still the same. Browser warnings aren't false, you're reading of them is false. Read around on badssl.com [0]. The self-signed warnings in chrome say: >Attackers might be trying to steal your information from self-signed.badssl.com (for example, passwords, messages, or credit cards). And when you click advanced chrome says: >This server could not prove that it is self-signed.badssl.com; its security certificate is not trusted by your computer's operating system. This may be caused by a misconfiguration or an attacker intercepting your connection. It says nothing about the encryption being bad, I don't know where you got that from. What it does say is that Chrome has no way to validate that the site you are going to is actually the site in the address bar. Encryption is pointless if anyone and everyone knows the password (oversimplified, but you get the point). Encryption without Authentication is as secure as normal HTTP. [0] https://badssl.com/ https://badssl.com/
      - 9y ago