5 ms·

Man, I cringed when he (OP in this case) said that "it's honestly kind of insane that we require encryption for text based websites like .. let's go to Wikipedi

by Operyl 7y ago

Man, I cringed when he (OP in this case) said that "it's honestly kind of insane that we require encryption for text based websites like .. let's go to Wikipedia." (Around 4m in the video). I'm sorry, but no .. it's not insane that we require that in this day and age. Otherwise, this looks pretty cool, will watch it further when I get the time. EDIT: Answering his next question: "Why does it really matter?" One reason is simple: These pages link to login and registration pages. If it's not authenticated, and can be modified over the wire, then an attacker could just redirect you to a different "login" page. TLS/SSL authenticates that what you received is what you expected, and that's very important on the internet in this day and age.

kevingadd 7y ago
Historically tradition is to encrypt the login, registration and administration pages, which is what people have been doing for decades. Full encryption of everything has advantages but that's not it.
- Operyl 7y ago
  And then it was later found out that, like I detailed in my edit, that that wasn't enough. Attackers could just modify the login page link on any unencrypted page and phish you that way. What I described is just one of many reasons the industry as a whole pushed to full-encryption.
- andkenneth 7y ago
  Yes, of course you encrypt those, but you also need to link any page which can link to those as well, otherwise an attacker could put a link on the page which goes to their cred harvesting page instead of the secure login page.
AbraKdabra 7y ago
I'm glad I am not the only one who stared at the monitor with my "what the hell did I just hear" face when he said that.
rogerclark 7y ago
I definitely understand the concerns that make people want encryption for everything -- preventing governments and ISPs from messing with your content or spying on you. I don't want that either, and I'm glad we have HTTPS to help fight that. But everything is a tradeoff, and there are actual downsides here. Nowadays, Chrome and Firefox try pretty hard to make you think all non-HTTPS sites are bad for you. What about old web servers that people never bothered to update? They effectively become "broken" without actually breaking. There's tons of great information on sites without updated certs that becomes that much harder to access because of this. There's also the concern about your actual codebase. Hypothetically, if you're building an HTTP client from scratch, you can write, know and understand every line of code in your project yourself. If you want HTTPS support, you're basically forced to link with OpenSSL, and this is almost guaranteed to take the total percentage of "your code" in your project from 100% to less than 10%. (Probably more like 1%.) You no longer actually know what's going on in your program anymore. Maybe this isn't a concern for most people, but it does matter to me -- and I suspect there are a lot of people who would care a bit more if they thought about it for a few seconds. So yeah, HTTPS is great. But everything is more complicated than it seems.
- Operyl 7y ago
  You're already linking against far larger libraries that you probably don't understand completely anyway! For example, glibc... So I don't think this is a valid excuse against the "HTTPS Everywhere" initiative.
  - rogerclark 7y ago
    That's not always true, especially if you're working in an embedded environment or you have other needs (business or legal requirements, even just preferences) to control the libraries you link with. In the case of this video series, I won't be using any C runtime library functionality at all -- just Windows API calls. Of course, there's always the operating system, which is big and opaque. IMO, there's a difference between interfacing with the platform and dragging in a bunch of other people's code. That's a personal call: it's not a clear cut line, obviously. Speaking personally, I more or less know, in general (and for Windows, in specific) how operating systems work. I don't have a strong understanding of encryption, which is heavily mathematical. In the case of OpenSSL, I am not likely to understand what it's doing. In the case of message queues, threads and blitting bitmaps, there's not much mystery there. Also, the comments I'm making are specifically about this project, not generally about how I think everyone should work. It's clear that this is an art project and not industrial software.
saagarjha 7y ago
Another reason is that certain networks will inject ads and other unwanted content into your webpages unless they’re transmitted over SSL.
- paulryanrogers 7y ago
  I thought this was unlikely in the real world until my new ISP did it on day one. And in other countries I've visited even HTTPS is intercepted.

by Operyl 7y ago

kevingadd 7y ago

Historically tradition is to encrypt the login, registration and administration pages, which is what people have been doing for decades. Full encryption of everything has advantages but that's not it.

Operyl 7y ago
And then it was later found out that, like I detailed in my edit, that that wasn't enough. Attackers could just modify the login page link on any unencrypted page and phish you that way. What I described is just one of many reasons the industry as a whole pushed to full-encryption.
andkenneth 7y ago
Yes, of course you encrypt those, but you also need to link any page which can link to those as well, otherwise an attacker could put a link on the page which goes to their cred harvesting page instead of the secure login page.

AbraKdabra 7y ago

I'm glad I am not the only one who stared at the monitor with my "what the hell did I just hear" face when he said that.

rogerclark 7y ago

I definitely understand the concerns that make people want encryption for everything -- preventing governments and ISPs from messing with your content or spying on you. I don't want that either, and I'm glad we have HTTPS to help fight that. But everything is a tradeoff, and there are actual downsides here. Nowadays, Chrome and Firefox try pretty hard to make you think all non-HTTPS sites are bad for you. What about old web servers that people never bothered to update? They effectively become "broken" without actually breaking. There's tons of great information on sites without updated certs that becomes that much harder to access because of this. There's also the concern about your actual codebase. Hypothetically, if you're building an HTTP client from scratch, you can write, know and understand every line of code in your project yourself. If you want HTTPS support, you're basically forced to link with OpenSSL, and this is almost guaranteed to take the total percentage of "your code" in your project from 100% to less than 10%. (Probably more like 1%.) You no longer actually know what's going on in your program anymore. Maybe this isn't a concern for most people, but it does matter to me -- and I suspect there are a lot of people who would care a bit more if they thought about it for a few seconds. So yeah, HTTPS is great. But everything is more complicated than it seems.

Operyl 7y ago
You're already linking against far larger libraries that you probably don't understand completely anyway! For example, glibc... So I don't think this is a valid excuse against the "HTTPS Everywhere" initiative.
- rogerclark 7y ago
  That's not always true, especially if you're working in an embedded environment or you have other needs (business or legal requirements, even just preferences) to control the libraries you link with. In the case of this video series, I won't be using any C runtime library functionality at all -- just Windows API calls. Of course, there's always the operating system, which is big and opaque. IMO, there's a difference between interfacing with the platform and dragging in a bunch of other people's code. That's a personal call: it's not a clear cut line, obviously. Speaking personally, I more or less know, in general (and for Windows, in specific) how operating systems work. I don't have a strong understanding of encryption, which is heavily mathematical. In the case of OpenSSL, I am not likely to understand what it's doing. In the case of message queues, threads and blitting bitmaps, there's not much mystery there. Also, the comments I'm making are specifically about this project, not generally about how I think everyone should work. It's clear that this is an art project and not industrial software.

saagarjha 7y ago

Another reason is that certain networks will inject ads and other unwanted content into your webpages unless they’re transmitted over SSL.

paulryanrogers 7y ago
I thought this was unlikely in the real world until my new ISP did it on day one. And in other countries I've visited even HTTPS is intercepted.