3 ms·

HTTPS is definitely useful for preserving the integrity of data between the server and the end user. To be clear, I'm very pro-SSL and have used LetsEncrypt fo

HTTPS is definitely useful for preserving the integrity of data between the server and the end user. To be clear, I'm very pro-SSL and have used LetsEncrypt for years on all my domains. I was just taking issue with the notion that someone's web server serving static content could be breached just because it didn't have an SSL cert.

Spivak 5y ago
I mean define breached? I don't think anyone ever would say that without TLS you can use HTTP to drop into a shell on the server. But you can, largely arbitrarily, mess with the content of the site if you're adjacent to either the sever or client, or in the path between them. Maybe this matters a lot for someone's security, maybe it doesn't at all.
- gsich 5y ago
  Breached as in someone else has control over the server.
  - cpach 5y ago
    If you can hijack the connection (i.e. MITM) you don’t need to control the server in order to compromise the integrity of the information.
    - gsich 5y ago
      True, but this would not satisfy "breached".