4 ms·

I agree. HTTPS is great, at definitely needed for a lot of things. But I don't need my cat pictures encrypted, I don't need lots of things encrypted, and frankl

by dusted 6y ago

I agree. HTTPS is great, at definitely needed for a lot of things. But I don't need my cat pictures encrypted, I don't need lots of things encrypted, and frankly, I don't want it to be encrypted when it's not required, it's a waste of resources, both processing and network. Then there is the case of all the old computers that either lack the processing power or support for modern algorithms.

antonyh 6y ago
When there's executable code there needs to be encryption. JS HTML CSS WASM etc ...all need to be tamper-resistant. Processing power, meh. More of an issue is older devices not getting the updates to software for the newer algorithms, and not getting the updated certificates. I got rid of a perfectly good tablet for just this reason. A bit slow perhaps but workable.
autoexec 6y ago
I'd be more receptive to this if ISPs weren't snooping on traffic and selling their customer's browsing history. As long as we have to operate under the assumption that every scrap of data we send or request will be picked apart and used against us whenever possible I'd rather encrypt everything and have a little less to worry about.
- m_eiman 6y ago
  Perhaps you should get some better laws in your country to prevent this, instead of ruining the web for the rest of the world?
  - snazz 6y ago
    Sorry to burst your bubble, but intelligence agencies are going to be monitoring your traffic regardless. The Internet is a global network; laws in specific countries or economic zones don't affect data in transit through other parts of the world.
visarga 6y ago
> I don't need my cat pictures encrypted Because all images are of cats or it's easy to tell when it's sensitive and when not.
jaas 6y ago
If a page doesn't use HTTPS, even if it is cats, you cannot trust that the traffic has not been modified in transit. You try to load a cat but a network attacker can add malware or mining code or a worse exploit. Every page needs HTTPS because you can't trust any content sent to you over HTTP. You don't know if it's "just a cat picture."
- bullen 6y ago
  Only routing owners can modify the cat picture, do you think they can afford to when the browser does not "run" the cat picture?
  - josephcsible 6y ago
    Image decoders occasionally have RCE vulnerabilities.
    - bullen 6y ago
      I think the solution in this case is to not execute code in pictures rather than removing HTTP? Also I'm starting to suspect the downvoting feature is used a sadistic tool, just keeping karma up so you can punish people.
      - johncolanduoni 6y ago
        They don't intentionally execute any code, they do sometimes have a vulnerability that allows memory corruption in a way that can be exploited to run attacker-provided code. If you're not familiar with this omnipresent class of exploit, I wouldn't hope for many people on HN to take your advice on whether a security measure is needed or not seriously. Even if your comments were underlined and flashing on the page instead of grayed out.
abdullahkhalids 6y ago
You don't need your cat pictures encrypted per se, but you do want to ensure that your Webportal cannot MITM your communications with catpictures.com and inject malicious javascript into the webpage.
- saalweachter 6y ago
  In an adversarial situation, you also want your opponent to spend time and resources storing or cracking gigabytes of cat pictures for every kilobyte of email they get.
imtringued 6y ago
Here is the thing. If you enter domain.com into the address bar of your browser, your browser will always go to the http site unless you do HSTS preloading. Your first visit to a website is not secured by https. So lots of people do a http -> https redirect, which means you can do a man in the middle attack on the http port and the HSTS header will never get loaded in the first place. https is significantly less effective than it should be.

by dusted 6y ago

antonyh 6y ago

When there's executable code there needs to be encryption. JS HTML CSS WASM etc ...all need to be tamper-resistant. Processing power, meh. More of an issue is older devices not getting the updates to software for the newer algorithms, and not getting the updated certificates. I got rid of a perfectly good tablet for just this reason. A bit slow perhaps but workable.

autoexec 6y ago

I'd be more receptive to this if ISPs weren't snooping on traffic and selling their customer's browsing history. As long as we have to operate under the assumption that every scrap of data we send or request will be picked apart and used against us whenever possible I'd rather encrypt everything and have a little less to worry about.

m_eiman 6y ago
Perhaps you should get some better laws in your country to prevent this, instead of ruining the web for the rest of the world?
- snazz 6y ago
  Sorry to burst your bubble, but intelligence agencies are going to be monitoring your traffic regardless. The Internet is a global network; laws in specific countries or economic zones don't affect data in transit through other parts of the world.

visarga 6y ago

> I don't need my cat pictures encrypted Because all images are of cats or it's easy to tell when it's sensitive and when not.

jaas 6y ago

If a page doesn't use HTTPS, even if it is cats, you cannot trust that the traffic has not been modified in transit. You try to load a cat but a network attacker can add malware or mining code or a worse exploit. Every page needs HTTPS because you can't trust any content sent to you over HTTP. You don't know if it's "just a cat picture."

bullen 6y ago
Only routing owners can modify the cat picture, do you think they can afford to when the browser does not "run" the cat picture?
- josephcsible 6y ago
  Image decoders occasionally have RCE vulnerabilities.
  - bullen 6y ago
    I think the solution in this case is to not execute code in pictures rather than removing HTTP? Also I'm starting to suspect the downvoting feature is used a sadistic tool, just keeping karma up so you can punish people.
    - johncolanduoni 6y ago
      They don't intentionally execute any code, they do sometimes have a vulnerability that allows memory corruption in a way that can be exploited to run attacker-provided code. If you're not familiar with this omnipresent class of exploit, I wouldn't hope for many people on HN to take your advice on whether a security measure is needed or not seriously. Even if your comments were underlined and flashing on the page instead of grayed out.

abdullahkhalids 6y ago

You don't need your cat pictures encrypted per se, but you do want to ensure that your Webportal cannot MITM your communications with catpictures.com and inject malicious javascript into the webpage.

saalweachter 6y ago
In an adversarial situation, you also want your opponent to spend time and resources storing or cracking gigabytes of cat pictures for every kilobyte of email they get.

imtringued 6y ago

Here is the thing. If you enter domain.com into the address bar of your browser, your browser will always go to the http site unless you do HSTS preloading. Your first visit to a website is not secured by https. So lots of people do a http -> https redirect, which means you can do a man in the middle attack on the http port and the HSTS header will never get loaded in the first place. https is significantly less effective than it should be.