3 ms·

It’s all moot as I said. It is the only game in town and the game is whack-a-mole. The mole will be whacked and we will be screwed. As is running out of IPv4 a

It’s all moot as I said. It is the only game in town and the game is whack-a-mole. The mole will be whacked and we will be screwed. As is running out of IPv4 addresses. I just decided not to stance on such issues like self-signed as it’s a pointless to go down that rabbit hole. >Respectfully, you were mistaken on several points of fact. It's quite clear that some of this stuff is new to you Sure, why not. I’ve withheld my bragging but thirteen years of depressing soul destroying System Operator/Administrator experience including Linux,Unix,Solaris and *BSD within high secure data centres,banks,pornography,animation,telecoms who knows what else. Two years is the max I can take because the field, software, hardware is so stale it hurts. I still disagree you can encrypt and secure the channel within a app. Why would it be impossible? > What's the alternative? self signed certificates. moot. take it as you wish.

MaxBarraclough 7y ago
I caught you mid-edit so forgive some stale quotes: > It’s all moot as I said It absolutely isn't. Security matters. HTTPS matters. This stuff is real. When a website argues for why it shouldn't bother with HTTPS, it's generally because they don't know what they're talking about, and they end up putting users at risk. Personal favourite: [0] > It’s the only game in town and the game is whack-a-mole. HTTPS is doing pretty well. There's always some element of whack-a-mole with security matters like this. (Personally I favour different metaphorical mammals: cat and mouse.) Even OpenBSD doesn't have a perfect record. Perfection shouldn't be the enemy of progress. We have online banking and online tax forms thanks to HTTPS, for instance. Without crypto, these simply wouldn't be possible. When we read of lawyers using fax machines, that shouldn't reassure us that plaintext HTTP is perfectly fine, it should alarm us that such an important profession has such inadequate security practices. > As is running out of IPv4 addresses. I agree this isn't exactly a good situation, but it's not going to paralyse the Internet. Worst case: the price of an IP goes up. Best case: IPv6 at last. > And yes, you can encrypt the channel within a app You've ignored the point I made. Are we talking about a web app, or a conventional app? If it's a conventional app: yes, you can layer your own cryto atop raw TCP, but it's a terrible idea. You should use HTTPS, or use TLS directly, or if you're in a Unix mood you could use SSH. There is no reason for doing otherwise. You cannot avoid the questions of key-management by handling the crypto yourself, you're not improving anything fundamentally, all you're doing is risking introducing easily-avoided security bugs. If it's a web app: you simply cannot, because you have to securely deliver the crypto software to the end-user, which you cannot do without HTTPS. > I just decided not to debate those issues as such as self signed as it’s a pointless to go on about Do please go ahead. The point of HN is discussion, after all. > self signed certificates. These do not protect you against a man-in-the-middle attack. They do not protect you from connecting to a host under the control of an attacker, posing as the real host. They only give you protection against passive data-capture. That, and a false sense of security. Were you unaware of this? [0] https://arstechnica.com/information-technology/2017/03/firefox-gets-complaint-for-labeling-unencrypted-login-page-insecure/ https://arstechnica.com/information-technology/2017/03/firef...
- doublerabbit 7y ago
  I am aware of your link, but only because we don’t have a public CA for self-signed or a mechanism to cover. Self signed can provide false sense of security but it’s still a certificate which provides encrypted passage that if you were to hypothetically say they were being used genuinely. They been left neglected. LetsEncrypt is essentially self-signed cert by submitter to a database owned by whoever. With a root certificate held up by Operating System creators. If I was to create an OS and not include the LetsEncrypt CA then errors would be thrown. As stated, I do not dismiss, nor am I arguing against it’s a insecure mechanism. It’s a requirement for the internet for now but putting all your eggs in one basket like LE, I’d rather let mine be cracked with insurance. However should be free regardless. I am taking about a webApp where the application itself is the web server. Within a webApp you can and If the simple principle of HTTP is “Give me index.html” to which the contents of the file are then submitted and spewed our by that browser read file > encrypt with some cipher decrypt > user Sure the packet can be mangled but based off your browser checksum the data is still not accessible. You can even then add your own packet checksum. If packet not checksum resend or route alternatively. This requires server end but it works. Example: my non-ssl mock web app http://virtualelementz.com/^poll http://virtualelementz.com/^poll Is a simple poll which uses text files instead of database. However without SSL and using naviserver (TCL) as my web server for now. Encrypted using Blowfish. All HTML is encrypted from first visit to submission result. The template files are stored in Hex encrypted, then decrypted, them ecrypto’s again for the user and then decrypted. All without javascript or libraries. None of that HTML can be modified in transit. You can validate the text has been encrypted and decrypting of this by looking at HTML source and seeing a ico at the top of the page. Although I will admit, this discussion has opened my eyes and I can now see where the MiTM attack will be, and HTTPs would be another coat of armour and that would which would be capturing which post you make. However I now need to encrypt the users click packet of POST. Connection Open > Html spewed > Connection closed User clicks option > Post result encrypted > update results file > I hate using my phone for in-depth discussions of my views which is why I’m obmitting answers + the UI of HN isn’t the greatest when you have a seven line box to type in. Can we just end this? I’m not stupid, I understand, but my own beliefs disagrees with the concepts currently in place. And I am constantly being forced to do stuff which feels uncesscalry like having to use Gmail to actually get a valid email service rather then my own. The internet I feel is on-life support to where it’s erupted with corporate greed who’s drilling it in to the ground. Like fracking. Maybe I’m just stuck in the 80’s where the internet was less of a thing as it is now. If it was me HN would be a BBS.

MaxBarraclough 7y ago

I caught you mid-edit so forgive some stale quotes: > It’s all moot as I said It absolutely isn't. Security matters. HTTPS matters. This stuff is real. When a website argues for why it shouldn't bother with HTTPS, it's generally because they don't know what they're talking about, and they end up putting users at risk. Personal favourite: [0] > It’s the only game in town and the game is whack-a-mole. HTTPS is doing pretty well. There's always some element of whack-a-mole with security matters like this. (Personally I favour different metaphorical mammals: cat and mouse.) Even OpenBSD doesn't have a perfect record. Perfection shouldn't be the enemy of progress. We have online banking and online tax forms thanks to HTTPS, for instance. Without crypto, these simply wouldn't be possible. When we read of lawyers using fax machines, that shouldn't reassure us that plaintext HTTP is perfectly fine, it should alarm us that such an important profession has such inadequate security practices. > As is running out of IPv4 addresses. I agree this isn't exactly a good situation, but it's not going to paralyse the Internet. Worst case: the price of an IP goes up. Best case: IPv6 at last. > And yes, you can encrypt the channel within a app You've ignored the point I made. Are we talking about a web app, or a conventional app? If it's a conventional app: yes, you can layer your own cryto atop raw TCP, but it's a terrible idea. You should use HTTPS, or use TLS directly, or if you're in a Unix mood you could use SSH. There is no reason for doing otherwise. You cannot avoid the questions of key-management by handling the crypto yourself, you're not improving anything fundamentally, all you're doing is risking introducing easily-avoided security bugs. If it's a web app: you simply cannot, because you have to securely deliver the crypto software to the end-user, which you cannot do without HTTPS. > I just decided not to debate those issues as such as self signed as it’s a pointless to go on about Do please go ahead. The point of HN is discussion, after all. > self signed certificates. These do not protect you against a man-in-the-middle attack. They do not protect you from connecting to a host under the control of an attacker, posing as the real host. They only give you protection against passive data-capture. That, and a false sense of security. Were you unaware of this? [0] https://arstechnica.com/information-technology/2017/03/firefox-gets-complaint-for-labeling-unencrypted-login-page-insecure/ https://arstechnica.com/information-technology/2017/03/firef...

doublerabbit 7y ago
I am aware of your link, but only because we don’t have a public CA for self-signed or a mechanism to cover. Self signed can provide false sense of security but it’s still a certificate which provides encrypted passage that if you were to hypothetically say they were being used genuinely. They been left neglected. LetsEncrypt is essentially self-signed cert by submitter to a database owned by whoever. With a root certificate held up by Operating System creators. If I was to create an OS and not include the LetsEncrypt CA then errors would be thrown. As stated, I do not dismiss, nor am I arguing against it’s a insecure mechanism. It’s a requirement for the internet for now but putting all your eggs in one basket like LE, I’d rather let mine be cracked with insurance. However should be free regardless. I am taking about a webApp where the application itself is the web server. Within a webApp you can and If the simple principle of HTTP is “Give me index.html” to which the contents of the file are then submitted and spewed our by that browser read file > encrypt with some cipher decrypt > user Sure the packet can be mangled but based off your browser checksum the data is still not accessible. You can even then add your own packet checksum. If packet not checksum resend or route alternatively. This requires server end but it works. Example: my non-ssl mock web app http://virtualelementz.com/^poll http://virtualelementz.com/^poll Is a simple poll which uses text files instead of database. However without SSL and using naviserver (TCL) as my web server for now. Encrypted using Blowfish. All HTML is encrypted from first visit to submission result. The template files are stored in Hex encrypted, then decrypted, them ecrypto’s again for the user and then decrypted. All without javascript or libraries. None of that HTML can be modified in transit. You can validate the text has been encrypted and decrypting of this by looking at HTML source and seeing a ico at the top of the page. Although I will admit, this discussion has opened my eyes and I can now see where the MiTM attack will be, and HTTPs would be another coat of armour and that would which would be capturing which post you make. However I now need to encrypt the users click packet of POST. Connection Open > Html spewed > Connection closed User clicks option > Post result encrypted > update results file > I hate using my phone for in-depth discussions of my views which is why I’m obmitting answers + the UI of HN isn’t the greatest when you have a seven line box to type in. Can we just end this? I’m not stupid, I understand, but my own beliefs disagrees with the concepts currently in place. And I am constantly being forced to do stuff which feels uncesscalry like having to use Gmail to actually get a valid email service rather then my own. The internet I feel is on-life support to where it’s erupted with corporate greed who’s drilling it in to the ground. Like fracking. Maybe I’m just stuck in the 80’s where the internet was less of a thing as it is now. If it was me HN would be a BBS.