5 ms·

Security depends on your threat model. HTTP is generally secure for publishing and has the added advantage of being cacheable by proxies. This blog is secure

by slim 9y ago

Sir_Cmpwn 9y ago
It can be MITM'd and used as a vector for malware.
sphix0r 9y ago
TLS = encryption TLS = authentication TLS = tamper proof
- dredmorbius 9y ago
  Largely, yes, modulo CA integrity and APT attacks.
cratermoon 9y ago
There is a lot more to the threat model than "will my content be stolen or compromised?"
inetknght 9y ago
> HTTP is generally secure This statement is wholly incorrect. HTTP is not generally secure. > for publishing When I publish something I do not intend for third parties to interfere with the delivery of what I publish. > and has the added advantage of being cacheable by proxies If you trust your proxy, you can still have cached data at your proxy. If you don't trust your proxy, then why are you proxying through it?
- dredmorbius 9y ago
  HTTP plus a trusted hash would provide an integrity measure of the content of a page, and enable hashing. It would not prevent anyone from examining that content in flight, or altering it. It would allow any such alteration to be identified. It is possible to offer various levels of assurance on unencrypted communications. Mind: I'm describing a possible world, not the one most of us happen to live in. Unless, say, you're retrieving Debian package repositories over FTP or HTTP transport, and rely on the package signature rather than HTTPS for integrity. See for example: https://unix.stackexchange.com/q/90227 https://unix.stackexchange.com/q/90227
  - inetknght 9y ago
    You cannot have a "trusted hash" if you cannot trust the delivery mechanism (unencrypted and unauthenticated TCP). The content of the delivered payload (your blog and your "trusted hash") can be altered by anyone in transit. When you take unencrypted and unauthenticated TCP and upgrade to encrypted and authenticated TLS, only then can you begin to have trust.
    - diamondo25 9y ago
      Except when a party also has the certificate information and private key and does a man in the middle attack without you knowing, because of resigning the data with the exact same key :)
    - dredmorbius 9y ago
      False. That is what PGP / GPG's Web of Trust offers.
    - kerkeslager 9y ago
      You can't have encryption without authentication, because a man in the middle can snoop your connection. You can have authentication without encryption. This is what PGP signed messages are. I'll admit it's weird to call a cryptographic signature a "trusted hash", which makes it seem like the author of the post you're responding to doesn't know what they're talking about. But it's totally possible to to have trust without encryption or TLS. TLS isn't even the best protocol for signing out there, as the whole thing depends on CAs being trustworthy (which they aren't). All that said, if you want trust on the internet, start with HTTPS. Sure, you don't need the encryption for delivering non-secret content, but it's the easiest way to set up trust and the only one non-technical people are likely to verify in any way (because their browser does it for them). It doesn't provide very strong guarantees, but it's better than nothing. If you want more go with PGP. And the fact that you can use PGP over HTTP doesn't in any way mean that HTTP is secure in general.
      - inetknght 9y ago
        > You can have authentication without encryption. This is what PGP signed messages are. Yes, but you must install the authorization certificate using a secure method. Honestly I think far too many CAs are "trusted" by default, especially for executing things (such as javascript) on my computer.
pjc50 9y ago
This just went past me on Twitter: https://twitter.com/lynyrd_cohyn/status/968977681210585090 https://twitter.com/lynyrd_cohyn/status/968977681210585090 (Malicious ad injection + HTTP = mobile billing)

Security depends on your threat model. HTTP is generally secure for publishing and has the added advantage of being cacheable by proxies. This blog is secure

by slim 9y ago

Security depends on your threat model. HTTP is generally secure for publishing and has the added advantage of being cacheable by proxies. This blog is secure

Sir_Cmpwn 9y ago

It can be MITM'd and used as a vector for malware.

sphix0r 9y ago

TLS = encryption TLS = authentication TLS = tamper proof

dredmorbius 9y ago
Largely, yes, modulo CA integrity and APT attacks.

cratermoon 9y ago

There is a lot more to the threat model than "will my content be stolen or compromised?"

inetknght 9y ago

> HTTP is generally secure This statement is wholly incorrect. HTTP is not generally secure. > for publishing When I publish something I do not intend for third parties to interfere with the delivery of what I publish. > and has the added advantage of being cacheable by proxies If you trust your proxy, you can still have cached data at your proxy. If you don't trust your proxy, then why are you proxying through it?

dredmorbius 9y ago
HTTP plus a trusted hash would provide an integrity measure of the content of a page, and enable hashing. It would not prevent anyone from examining that content in flight, or altering it. It would allow any such alteration to be identified. It is possible to offer various levels of assurance on unencrypted communications. Mind: I'm describing a possible world, not the one most of us happen to live in. Unless, say, you're retrieving Debian package repositories over FTP or HTTP transport, and rely on the package signature rather than HTTPS for integrity. See for example: https://unix.stackexchange.com/q/90227 https://unix.stackexchange.com/q/90227
- inetknght 9y ago
  You cannot have a "trusted hash" if you cannot trust the delivery mechanism (unencrypted and unauthenticated TCP). The content of the delivered payload (your blog and your "trusted hash") can be altered by anyone in transit. When you take unencrypted and unauthenticated TCP and upgrade to encrypted and authenticated TLS, only then can you begin to have trust.
  - diamondo25 9y ago
    Except when a party also has the certificate information and private key and does a man in the middle attack without you knowing, because of resigning the data with the exact same key :)
  - dredmorbius 9y ago
    False. That is what PGP / GPG's Web of Trust offers.
  - kerkeslager 9y ago
    You can't have encryption without authentication, because a man in the middle can snoop your connection. You can have authentication without encryption. This is what PGP signed messages are. I'll admit it's weird to call a cryptographic signature a "trusted hash", which makes it seem like the author of the post you're responding to doesn't know what they're talking about. But it's totally possible to to have trust without encryption or TLS. TLS isn't even the best protocol for signing out there, as the whole thing depends on CAs being trustworthy (which they aren't). All that said, if you want trust on the internet, start with HTTPS. Sure, you don't need the encryption for delivering non-secret content, but it's the easiest way to set up trust and the only one non-technical people are likely to verify in any way (because their browser does it for them). It doesn't provide very strong guarantees, but it's better than nothing. If you want more go with PGP. And the fact that you can use PGP over HTTP doesn't in any way mean that HTTP is secure in general.
    - inetknght 9y ago
      > You can have authentication without encryption. This is what PGP signed messages are. Yes, but you must install the authorization certificate using a secure method. Honestly I think far too many CAs are "trusted" by default, especially for executing things (such as javascript) on my computer.

pjc50 9y ago

This just went past me on Twitter: https://twitter.com/lynyrd_cohyn/status/968977681210585090 https://twitter.com/lynyrd_cohyn/status/968977681210585090 (Malicious ad injection + HTTP = mobile billing)