4 ms·
> The "HTTPS" part of Google's proposal is a bit of a red herring, as I said, only a baby step. It's in there for the same reason that risky APIs like geolocat
by duskwuff 6y ago
> The "HTTPS" part of Google's proposal is a bit of a red herring, as I said, only a baby step.
It's in there for the same reason that risky APIs like geolocation require HTTPS -- so that injecting content into an insecure HTTP transaction cannot allow an attacker to hijack a trusted HTTP site's permissions.
- _qulr 6y agoSure. But we've seen cases where so-called "trusted" https sites such as ebay are probing your LAN, so the fundamental problem remains. https://nullsweep.com/why-is-this-website-port-scanning-me/ https://nullsweep.com/why-is-this-website-port-scanning-me/