32 ms·

I'm surprised this took so long. I tried to find an extension recently that could completely block HTTP but I couldn't find anything.

Ajedi32 6y ago
HTTPS Everywhere[1] has a setting for that. [1]: https://chrome.google.com/webstore/detail/https-everywhere/gcbommkclmclpchllfjekcdonpmejbdp?hl=en https://chrome.google.com/webstore/detail/https-everywhere/g...
superkuh 6y ago
What you've described is, of course, what Google wants in the long run. For corporations making money on the web HTTPS is required and it makes a lot of sense. The problem is the web isn't just corporate sites involving money or private information. But if a browswer, or individual, begins blocking HTTP sites what they're effectively doing is saying, "Only sites approved by corporations should be visitable." This is a result of only corporations (no matter how non-profit or currently benevolent they are) being certificate authorities. A human person can't be a certificate authority. And that is a terrible blow to freedom on the web.
- Karunamon 6y ago
  You're not wrong, but plaintext needs to die for reasons everyone already understands. We can deal with the implementation details^wabuses later.
- Ajedi32 6y ago
  A human person can't be a DNS registrar either. TLS certs aren't a stamp of approval; they're just a statement saying "we've verified that this public key belongs to the owner of this domain".
  - superkuh 6y ago
    That's true, but I can still type in an IP address and communicate with any webserver I want on the entire internet. I guess you don't remember in 2018 when Comodo revoked sci-hub's TLS certs under corporate political pressure. This style of revocation combined with HTTPS only browsers is effectively a block that can't be bypassed. I am not saying that the DNS system cannot be used for political attack. It obviously can. It was used as such against sci-hub before they started attacking via the cert provider. What I am saying is that blocking HTTP in the browser makes the consequences much, much worse. It greatly increases the incentives for revoking TLS certs for political reasons due to increased effectiveness. The cert authority doesn't even have to be malicious. All they have to do is be "law abiding" relative to some country with a bad set of laws.
    - Ajedi32 6y ago
      Still not seeing how that's any different from DNS. I mean yes, obviously it's another possible point of failure. But I don't see MITM protection as being any less important than name resolution on the modern web. Seems no less reasonable for a site to break due to lack of MITM protection than for it to break due to failure of name resolution. Normal users aren't going to be manually looking up and navigating to IP addresses anymore than they're going to be manually installing TLS certificates.

Ajedi32 6y ago

HTTPS Everywhere[1] has a setting for that. [1]: https://chrome.google.com/webstore/detail/https-everywhere/gcbommkclmclpchllfjekcdonpmejbdp?hl=en https://chrome.google.com/webstore/detail/https-everywhere/g...

superkuh 6y ago

What you've described is, of course, what Google wants in the long run. For corporations making money on the web HTTPS is required and it makes a lot of sense. The problem is the web isn't just corporate sites involving money or private information. But if a browswer, or individual, begins blocking HTTP sites what they're effectively doing is saying, "Only sites approved by corporations should be visitable." This is a result of only corporations (no matter how non-profit or currently benevolent they are) being certificate authorities. A human person can't be a certificate authority. And that is a terrible blow to freedom on the web.

Karunamon 6y ago
You're not wrong, but plaintext needs to die for reasons everyone already understands. We can deal with the implementation details^wabuses later.
Ajedi32 6y ago
A human person can't be a DNS registrar either. TLS certs aren't a stamp of approval; they're just a statement saying "we've verified that this public key belongs to the owner of this domain".
- superkuh 6y ago
  That's true, but I can still type in an IP address and communicate with any webserver I want on the entire internet. I guess you don't remember in 2018 when Comodo revoked sci-hub's TLS certs under corporate political pressure. This style of revocation combined with HTTPS only browsers is effectively a block that can't be bypassed. I am not saying that the DNS system cannot be used for political attack. It obviously can. It was used as such against sci-hub before they started attacking via the cert provider. What I am saying is that blocking HTTP in the browser makes the consequences much, much worse. It greatly increases the incentives for revoking TLS certs for political reasons due to increased effectiveness. The cert authority doesn't even have to be malicious. All they have to do is be "law abiding" relative to some country with a bad set of laws.
  - Ajedi32 6y ago
    Still not seeing how that's any different from DNS. I mean yes, obviously it's another possible point of failure. But I don't see MITM protection as being any less important than name resolution on the modern web. Seems no less reasonable for a site to break due to lack of MITM protection than for it to break due to failure of name resolution. Normal users aren't going to be manually looking up and navigating to IP addresses anymore than they're going to be manually installing TLS certificates.