4 ms·
You should give it the exact same amount of trust as a plain HTTP connection. Which is exactly my point.
by halo 16y ago
You should give it the exact same amount of trust as a plain HTTP connection.
Which is exactly my point.
- burgerbrain 16y agoThen why the hell would you even use it? The fact is, even if the browser so much as displays "https" in the addressbar, you are giving the unknowlegable user a form of positive feedback when none whatsoever is warrented. Strong netagive feedback is a much more appropriate solution.
- _delirium 16y agoIt filters out some kinds of common attacks, e.g. most (all?) uses of Firesheep session-cookie snooping at coffee shops. Of course, for us nerd types https isn't really necessary for that, because I can just websurf over an ssh -D proxy to a VPS, to encrypt the coffee-shop side of the link.
- jodrellblank 16y agoYou would use it because it makes encrypted traffic on the network the norm. It makes it impossible to decipher your traffic without an active deliberate security attack instead of a passive sniffing session. It means when a traffic sniffer happens on your traffic they will get (plain text, encrypted data) and they won't know whether the encrypted data is 'good' or 'bad' and will have an easier time with the plain text - the "just have to run faster than the other guy" approach.
- tptacek 16y agoIt's not encrypted if the keys aren't secure.
- deleted 16y ago[deleted]
- deleted 16y ago[deleted]
- deleted 16y ago[deleted]