3 ms·
because cafe can just ask people 'install this extension to navigate' and non-tech users being users will fall for it most of the time, because state actor can
by LoSboccacc 7y ago
because cafe can just ask people 'install this extension to navigate' and non-tech users being users will fall for it most of the time, because state actor can do even worse, and once we trained the users that non green check is dangerous they won't have the knowledge to distinguish between "insecure with no check" and "maybe secure with check but I've to control every time the details", people will shortcut that part, until some researcher finds our for them and even then it's not guaranteed that the message will reach everyone
- XMPPwocky 7y agoExactly - this is why we don't want to train people that non-TLS traffic is insecure, but rather keep them from encountering it, ever, ideally. TLS must be the default- a baseline- and deviating from that baseline must be at least as hard as getting a user to install a malicious extension. Ever SSHed into a server and been told by your SSH client that, oh, by the way, the server is using the NULL cipher with no authentication, and network attackers can mess with your session arbitrarily? Probably not. That's what using plaintext HTTP should feel like.