5 ms·
If browsers supported a method to provide content securely without the need to encrypt everything, lots of uses of the web would not be hampered by the TLS-ever
by peterwwillis 8y ago
If browsers supported a method to provide content securely without the need to encrypt everything, lots of uses of the web would not be hampered by the TLS-everything-that-moves movement. The limitations we have accepted in our browsers are what causes these conflicts. But we don't have to accept them. We could do with less propaganda and more compromise and innovation.
- ezekg 8y agoI'm unsure on how you could do what you've said without encryption. Any ideas?
- ChrisSD 8y agoYou could securely sign the data in a tamper resistant way. Although that would be at least as disruptive to http as https is. And it also can't obscure the specific pages you're visiting.
- maxvu 8y agoCryptographic verification?
- ezekg 8y agoSure, but that would still leave the data open to the world. Not an alternative to TLS.
- peterwwillis 8y agoMost of the content on the web is intentionally open to the world.
- ezekg 8y agoBut our personal data is not. So much data is potentially made available from an unencrypted HTTP request.
- peterwwillis 8y agoNobody is saying that personal data should be unencrypted.
- paulddraper 8y agoDebian apt repos work this way. Everything has hashes or PGP signatures. It doesn't have to be encrypted to be trusted. In fact, anyone can set up a separate mirror and clients can use it with no concern about safety. It doesn't offer confidentiality, but it does offer integrity.