4 ms·

> HTTP is not ok actually, it is. HTTP is perfectly fine. [1] > Anyone can ready / modify what is being sent Anyone can break a window and enter my house.

> HTTP is not ok actually, it is. HTTP is perfectly fine. [1] > Anyone can ready / modify what is being sent Anyone can break a window and enter my house. But I haven't aired a private army to patroll the windows. NSA can break HTTPS, TGF exists and China Trusted SSL Certificates are a thing. False sense of security is often more dangerous than a real sense of insecurity. Edit: [1] how many of you don't terminate SSL at load balancer?

DANK_YACHT 4y ago
So because the government can potentially decrypt your traffic, you don't care if anyone can? Do you use online banking? Do you care if you transmit your password to your bank account in plaintext? What if you need to call your bank? Would you really trust a phone number delivered over HTTP? That just seems crazy to me.
- peoplefromibiza 4y ago
  > you don't care if anyone can? that's a very bald assumption, my dear friend. But in practice, yes, it is safe do not care of the possibility that someone is going to inject a script in your blog header, because I am no police officer, I do not work overtime, fighting crime. [1] Same way I'm not worried that someone is going to steal my car and use it to rob a bank or worse. > Do you use online banking? Banks also have guards at the doors. They handle other people's money, of course they care about it and about the safety of their employees. Are you a bank? > Do you care if you transmit your password to your bank account in plaintext? Not really. 99% of my passwords are passw0rd on websites I really don't care about. It is much harder, if not impossible, to guess my username. I bet I am not the only one. Besides, my bank ask me to confirm any operation in a MFA way. If they notice something strange, they call me, on my phone, a human calls me. It's their job. > Would you really trust a phone number delivered over HTTP? I've trusted for the majority of my life phone numbers sent unencrypted through wires that everybody could wiretap to and then by email... Nothing bad ever happened. Besides, what can happen if you call the wrong number? I do not believe that the Grudge is a real story. The point is: no, I am not paranoid. Common sense is enough 99% of the times. [1] https://www.youtube.com/watch?v=o2Z1yLO9C-Q https://www.youtube.com/watch?v=o2Z1yLO9C-Q
criddell 4y ago
HTTP has been used as an attack vector in the past and there’s no reason to think it won’t be again in the future. HTTPS on your site protects the rest of us from it being used by things like China’s Great Cannon.
- peoplefromibiza 4y ago
  > HTTP has been used as an attack vector in the past and there’s no reason to think it won’t be again in the future so has been HTTPS > HTTPS on your site protects the rest of us from it being used by things like China’s Great Cannon. I'm not scared by China, I'm scared by the fact that NSA already controls some of the certs in the so called "trusted" authorities, because, you know, "matter of national security" or "patriot act".
philsnow 4y ago
> how many of you don't terminate SSL at load balancer? Oof, this just reminds me of the whole PRISM thing [0] where NSA was tapping inter-DC fiber links and Google wasn't encrypting (some of) the traffic between DCs [0] https://slate.com/technology/2013/10/nsa-smiley-face-muscular-spying-on-google-yahoo-speaks-volumes-about-agency-s-attitude.html https://slate.com/technology/2013/10/nsa-smiley-face-muscula...
- peoplefromibiza 4y ago
  Yep, if you are Google you should put in place every layer of security you can think of and then double them. But there's only a few Google around. Besides, NSA can (and probably already is) collect encrypted streams and then try to break them offline. Real time is not an hard requirement for them. if what you are doing doesn't require secrecy, HTTP could suffice. Imagine you built an app for weather reporting, the app downloads static json from a server using the hardcoded ip address. HTTPS would add no benefit, worst that can happen is that someone hijacks the ip address (for some of the users, it's not possible to do it worldwide) and point the app to the wrong jsons, that might or might no be valid for the app. Which is a lot of effort to break a weather app...

DANK_YACHT 4y ago

So because the government can potentially decrypt your traffic, you don't care if anyone can? Do you use online banking? Do you care if you transmit your password to your bank account in plaintext? What if you need to call your bank? Would you really trust a phone number delivered over HTTP? That just seems crazy to me.

peoplefromibiza 4y ago
> you don't care if anyone can? that's a very bald assumption, my dear friend. But in practice, yes, it is safe do not care of the possibility that someone is going to inject a script in your blog header, because I am no police officer, I do not work overtime, fighting crime. [1] Same way I'm not worried that someone is going to steal my car and use it to rob a bank or worse. > Do you use online banking? Banks also have guards at the doors. They handle other people's money, of course they care about it and about the safety of their employees. Are you a bank? > Do you care if you transmit your password to your bank account in plaintext? Not really. 99% of my passwords are passw0rd on websites I really don't care about. It is much harder, if not impossible, to guess my username. I bet I am not the only one. Besides, my bank ask me to confirm any operation in a MFA way. If they notice something strange, they call me, on my phone, a human calls me. It's their job. > Would you really trust a phone number delivered over HTTP? I've trusted for the majority of my life phone numbers sent unencrypted through wires that everybody could wiretap to and then by email... Nothing bad ever happened. Besides, what can happen if you call the wrong number? I do not believe that the Grudge is a real story. The point is: no, I am not paranoid. Common sense is enough 99% of the times. [1] https://www.youtube.com/watch?v=o2Z1yLO9C-Q https://www.youtube.com/watch?v=o2Z1yLO9C-Q

criddell 4y ago

HTTP has been used as an attack vector in the past and there’s no reason to think it won’t be again in the future. HTTPS on your site protects the rest of us from it being used by things like China’s Great Cannon.

peoplefromibiza 4y ago
> HTTP has been used as an attack vector in the past and there’s no reason to think it won’t be again in the future so has been HTTPS > HTTPS on your site protects the rest of us from it being used by things like China’s Great Cannon. I'm not scared by China, I'm scared by the fact that NSA already controls some of the certs in the so called "trusted" authorities, because, you know, "matter of national security" or "patriot act".

philsnow 4y ago

> how many of you don't terminate SSL at load balancer? Oof, this just reminds me of the whole PRISM thing [0] where NSA was tapping inter-DC fiber links and Google wasn't encrypting (some of) the traffic between DCs [0] https://slate.com/technology/2013/10/nsa-smiley-face-muscular-spying-on-google-yahoo-speaks-volumes-about-agency-s-attitude.html https://slate.com/technology/2013/10/nsa-smiley-face-muscula...

peoplefromibiza 4y ago
Yep, if you are Google you should put in place every layer of security you can think of and then double them. But there's only a few Google around. Besides, NSA can (and probably already is) collect encrypted streams and then try to break them offline. Real time is not an hard requirement for them. if what you are doing doesn't require secrecy, HTTP could suffice. Imagine you built an app for weather reporting, the app downloads static json from a server using the hardcoded ip address. HTTPS would add no benefit, worst that can happen is that someone hijacks the ip address (for some of the users, it's not possible to do it worldwide) and point the app to the wrong jsons, that might or might no be valid for the app. Which is a lot of effort to break a weather app...