4 ms·
I appreciate the effort, but there's something that rubs me the wrong way about the state of this "force the world to always encrypt and offer no alternative",
by dusted 5y ago
I appreciate the effort, but there's something that rubs me the wrong way about the state of this "force the world to always encrypt and offer no alternative", the same beef I have with Gemini.
"Take perfectly good protocol" -> "Wrap encryption around it" -> "Only offer encrypted version even though the plaintext version is right there" -> "Use third-party tool and extra infrastructure to unwrap perfectly good protocol before it can be used".
- smackeyacky 5y agoI sympathise somewhat but unfortunately the popularity of the internet means those innocent days of unencrypted information have been made dangerous due to too many bad actors. Like usenet, it's gone, it's not coming back. We shrug and move on.
- samatman 5y agoI mentioned this in another thread, but given a secure way to acquire public keys, MITM attacks can be fully mitigated with signatures rather than payload encryption. A tiny client doesn't have to bother checking this signature, anything capable of receiving encrypted data could be just as sure that the payload is byte-identical with the author's intention as TLS makes possible. The difference is everyone gets to read your postcard if they want, but I'm with you: if I have an AVR barely able to GET the weather report, and strip numbers out of it if the JSON schema doesn't change even slightly, what problem is going to arise from some bad actor reading that packet on the way in? If Mallory starts messing with my dumb Arduino garden I can set up a firewall that checks the signatures. It's progressive enhancement with graceful degradation.