5 ms·

As a content provider this is why you need HTTPS, and it's why you should ensure you certificate is in the transparency logs, and that your site requires CT ent

by jopsen 7y ago

As a content provider this is why you need HTTPS, and it's why you should ensure you certificate is in the transparency logs, and that your site requires CT entries.

masswerk 7y ago
However, this is more like "better have a lock so that thieves have a harder time breaking the door". If the US are making IP violations legal, they put themselves in danger to be treated like other countries who are considered notoriously ignoring IP as part of their overall business model.
- jopsen 7y ago
  True.. The sad thing is that with many kinds of cybercrime, it's easier to fix the security vulnerability, than it is to track down the criminals and make them stop :) In this case, the vulnerability is using HTTP, not HTTPS.
  - masswerk 7y ago
    Still, if we do not take care of bad actors, bad actors are what we get (and probably what we deserve). Edit: Also, what stops those ISPs from impersonating the requested host by means of their own root certificate, just like antivirus software does it?
    - Sohcahtoa82 7y ago
      Then my browser would throw a certificate warning unless I added my ISPs root cert.
      - masswerk 7y ago
        As pointed out by another comment already, "you" maybe as well the ISP's installer software.
red_trumpet 7y ago
Well, HTTPS could still be man-in-the-middled, right? I am not really informed, but I would not be surprised if some ISPs are even recognized as certificate authorities.
- jimktrains2 7y ago
  MITMing TLS requires either (1) a falsely issued certificate, which would be "a big deal" when (not if) found and would lead to the issuer losing their status as accepted in browsers, or (2) the user to install a certificate generated by the person doing the MITM, this is often done in corporate environments.
  - masswerk 7y ago
    Are we sure that there won't be an exception installed to this in favor of broadband providers, considering the paths already taken? Terms and conditions of this comment: This comment is provided for free to <https://news.ycombinator.com> https://news.ycombinator.com> AKA "Hacker News", including any redistribution to be considered under the clause of fair use. Any other redistribution, including injection of third party content or surrounding content, chrome, or any other HTML element(s), be it in static or generated code, is considered a violation of the terms of this contribution.
    - aaomidi 7y ago
      Your browser and OS quickly delist any certificate found to have forged a certificate for a website they don't own. They're unapologetic about it too - and don't care who they piss off.
      - masswerk 7y ago
        However, browsers have played along with US legislation previously. (E.g., when long key encryption was restricted to US versions only.) I'm not sure, if Mozilla would be playing along nowadays, but you can't be too sure, either. Moreover, you could consider certificates installed by antivirus software as some kind of prior art to this. (While considered a security risk, at least by some, they are not delisted.)

by jopsen 7y ago

As a content provider this is why you need HTTPS, and it's why you should ensure you certificate is in the transparency logs, and that your site requires CT entries.

masswerk 7y ago

However, this is more like "better have a lock so that thieves have a harder time breaking the door". If the US are making IP violations legal, they put themselves in danger to be treated like other countries who are considered notoriously ignoring IP as part of their overall business model.

jopsen 7y ago
True.. The sad thing is that with many kinds of cybercrime, it's easier to fix the security vulnerability, than it is to track down the criminals and make them stop :) In this case, the vulnerability is using HTTP, not HTTPS.
- masswerk 7y ago
  Still, if we do not take care of bad actors, bad actors are what we get (and probably what we deserve). Edit: Also, what stops those ISPs from impersonating the requested host by means of their own root certificate, just like antivirus software does it?
  - Sohcahtoa82 7y ago
    Then my browser would throw a certificate warning unless I added my ISPs root cert.
    - masswerk 7y ago
      As pointed out by another comment already, "you" maybe as well the ISP's installer software.

red_trumpet 7y ago

Well, HTTPS could still be man-in-the-middled, right? I am not really informed, but I would not be surprised if some ISPs are even recognized as certificate authorities.

jimktrains2 7y ago
MITMing TLS requires either (1) a falsely issued certificate, which would be "a big deal" when (not if) found and would lead to the issuer losing their status as accepted in browsers, or (2) the user to install a certificate generated by the person doing the MITM, this is often done in corporate environments.
- masswerk 7y ago
  Are we sure that there won't be an exception installed to this in favor of broadband providers, considering the paths already taken? Terms and conditions of this comment: This comment is provided for free to <https://news.ycombinator.com> https://news.ycombinator.com> AKA "Hacker News", including any redistribution to be considered under the clause of fair use. Any other redistribution, including injection of third party content or surrounding content, chrome, or any other HTML element(s), be it in static or generated code, is considered a violation of the terms of this contribution.
  - aaomidi 7y ago
    Your browser and OS quickly delist any certificate found to have forged a certificate for a website they don't own. They're unapologetic about it too - and don't care who they piss off.
    - masswerk 7y ago
      However, browsers have played along with US legislation previously. (E.g., when long key encryption was restricted to US versions only.) I'm not sure, if Mozilla would be playing along nowadays, but you can't be too sure, either. Moreover, you could consider certificates installed by antivirus software as some kind of prior art to this. (While considered a security risk, at least by some, they are not delisted.)