4 ms·

> Can anybody suggest what might be the motivation for this? The push for HTTPS everywhere started with HR4681[1] both of which were reactions to Snowden revel

by nanis 5y ago

> Can anybody suggest what might be the motivation for this? The push for HTTPS everywhere started with HR4681[1] both of which were reactions to Snowden revelations. > Beyond the silly "bad people might tamper with the cat picture you're shown" one that is always given? Someone who is able to tamper with the cat picture you are seeing can also inject arbitrary code into your computer, so there is that. Also, thanks to the push for HTTPS everywhere, a large volume of traffic now goes through CloudFlare enabling them to do that on behalf of state actors etc (I am not claiming they do it, but it is kind of ironic that the least friction thing for me to enable HTTPS on a whole bunch of sites was to put a MITM ;-) Totally love CloudFlare BTW. The free level covers what I need. Still, it is ironic. [1]: https://www.nu42.com/2014/12/https-everywhere-and-hr4681.html https://www.nu42.com/2014/12/https-everywhere-and-hr4681.htm...

tialaramex 5y ago
Why single out HR4681? The IETF's Best Common Practice #188 "Pervasive Monitoring Is an Attack" is months earlier in terms of reactions to Snowden and is a direct trigger for this work which doesn't involve stoner thinking ("What if, like, the government snooping is actually reverse psychology to trick us into hiding stuff from them")
- nanis 5y ago
  Because, at the time, HR 4681 was heralded as _limiting_ the U.S. government's ability to monitor and retain communications of U.S. citizens when, in fact, coupled with omnipresent encryption actually explicitly made it legal to retain such communications indefinitely. Copying the plain language here: "... Limitation on retention.–A covered communication shall not be retained in excess of 5 years, unless– ... (iii) the communication is enciphered or reasonably believed to have a secret meaning;"
perryizgr8 5y ago
> Someone who is able to tamper with the cat picture you are seeing can also inject arbitrary code into your computer, so there is that. Someone can just inject arbitrary code into your computer using a site with an SSL cert. It's very easy to get a free one nowadays, judging from the other threads. Why are middle-men so important to protect against? The site owners are the usual source of attacks.

by nanis 5y ago

tialaramex 5y ago

Why single out HR4681? The IETF's Best Common Practice #188 "Pervasive Monitoring Is an Attack" is months earlier in terms of reactions to Snowden and is a direct trigger for this work which doesn't involve stoner thinking ("What if, like, the government snooping is actually reverse psychology to trick us into hiding stuff from them")

nanis 5y ago
Because, at the time, HR 4681 was heralded as _limiting_ the U.S. government's ability to monitor and retain communications of U.S. citizens when, in fact, coupled with omnipresent encryption actually explicitly made it legal to retain such communications indefinitely. Copying the plain language here: "... Limitation on retention.–A covered communication shall not be retained in excess of 5 years, unless– ... (iii) the communication is enciphered or reasonably believed to have a secret meaning;"

perryizgr8 5y ago

> Someone who is able to tamper with the cat picture you are seeing can also inject arbitrary code into your computer, so there is that. Someone can just inject arbitrary code into your computer using a site with an SSL cert. It's very easy to get a free one nowadays, judging from the other threads. Why are middle-men so important to protect against? The site owners are the usual source of attacks.