4 ms·

I find the same abundant misrepresentation about SSL. SSL is important but a valid SSL certificate doesn't mean a site is safe. An invalid (or nonexistent) SS

I find the same abundant misrepresentation about SSL. SSL is important but a valid SSL certificate doesn't mean a site is safe. An invalid (or nonexistent) SSL/TLS certificate doesn't mean a site is illegitimate. A site without a user facing login really doesn't need SSL. And SSL is pointless on said site if it's for instance a Let's Encrypt. An example of misleading info (highlighted): https://www.cloudflare.com/learning/ssl/what-is-domain-spoofing/#:~:text=Make%20sure%20there's%20an%20SSL%20certificate https://www.cloudflare.com/learning/ssl/what-is-domain-spoof...

birdyrooster 5y ago
"And SSL is pointless on said site if it's for instance a Let's Encrypt." That isn't pointless SSL. Let's Encrypt isn't going to protect you from nation states, but cyber criminals aren't going to be invested or necessarily sophisticated enough to get Let's Encrypt's CA keys. Also, if you are worried someone will take over your Let's Encrypt automation and generate new certificates, they probably could use the same RCE to get at your private keys or directly sniff traffic from the compromised system. If you qualified this statement with "if the business is large cap", everyone would agree but then again that's why BigCo uses traditional CAs or roll their own.
bruce511 5y ago
There's this common misconception that sans user input a site is fine without https. Unfortunately this is not the case. Site security serves not only the purpose of protecting user input, but also ensuring that the data you are receiving has not been altered, ammended or replaced. At the low level it stops an ISP injecting their own ads or tracking, at the high level it prevents the injection of malicious code downstream from the site itself. Things like link-replacement, javascript injection, altered text, and so on make even read-only style sites untrustworthy over plain http.
- Qwertious 5y ago
  http://davisr.me http://davisr.me
- 411111111111111 5y ago
  And there is precident of isps injecting/replacing ads on non-https requests. This is not a theoretical issue which could technically become real, it's actually being done.
Moodles 5y ago
> A site without a user facing login really doesn't need SSL. And SSL is pointless on said site if it's for instance a Let's Encrypt. Depends what you mean by need. SSL/TLS still provides benefits like privacy (from third parties) on what you're viewing on the site, as well as no malicious content being injected. It's not just useful to protect your POST requests of username and password.
deepstack 5y ago
>A site without a user facing login really doesn't need SSL. And SSL is pointless on said site if it's for instance a Let's Encrypt. Depending on the ISP is trust worthy. In this day and age, none is trust worthy. Any network between server and browser can alter the content if it is NOT ssl encrypted. In US it is very often you see Verizon (not to single them out) modify the http content before they deliver to you. I guess it all comes down to if you want to get the actual content that is unmodified by the network routes between you and the server.

birdyrooster 5y ago

"And SSL is pointless on said site if it's for instance a Let's Encrypt." That isn't pointless SSL. Let's Encrypt isn't going to protect you from nation states, but cyber criminals aren't going to be invested or necessarily sophisticated enough to get Let's Encrypt's CA keys. Also, if you are worried someone will take over your Let's Encrypt automation and generate new certificates, they probably could use the same RCE to get at your private keys or directly sniff traffic from the compromised system. If you qualified this statement with "if the business is large cap", everyone would agree but then again that's why BigCo uses traditional CAs or roll their own.

bruce511 5y ago

There's this common misconception that sans user input a site is fine without https. Unfortunately this is not the case. Site security serves not only the purpose of protecting user input, but also ensuring that the data you are receiving has not been altered, ammended or replaced. At the low level it stops an ISP injecting their own ads or tracking, at the high level it prevents the injection of malicious code downstream from the site itself. Things like link-replacement, javascript injection, altered text, and so on make even read-only style sites untrustworthy over plain http.

Qwertious 5y ago
http://davisr.me http://davisr.me
411111111111111 5y ago
And there is precident of isps injecting/replacing ads on non-https requests. This is not a theoretical issue which could technically become real, it's actually being done.

Moodles 5y ago

> A site without a user facing login really doesn't need SSL. And SSL is pointless on said site if it's for instance a Let's Encrypt. Depends what you mean by need. SSL/TLS still provides benefits like privacy (from third parties) on what you're viewing on the site, as well as no malicious content being injected. It's not just useful to protect your POST requests of username and password.

deepstack 5y ago

>A site without a user facing login really doesn't need SSL. And SSL is pointless on said site if it's for instance a Let's Encrypt. Depending on the ISP is trust worthy. In this day and age, none is trust worthy. Any network between server and browser can alter the content if it is NOT ssl encrypted. In US it is very often you see Verizon (not to single them out) modify the http content before they deliver to you. I guess it all comes down to if you want to get the actual content that is unmodified by the network routes between you and the server.