3 ms·
Plain HTTP is synonymous with trust. In an ideal world where no one would snoop or mangle responses, it should be enough. In our still-imperfect world with pot
by strogonoff 4y ago
Plain HTTP is synonymous with trust. In an ideal world where no one would snoop or mangle responses, it should be enough.
In our still-imperfect world with potential MITM attacks, sometimes that trust is not warranted. However, one still should be able to choose to trust own connection. I don’t want this choice to be made for me with no way to appeal.
- Sohcahtoa82 4y agoIt's not just your own connection, it's every device your packets flow through. And if you use Comcast/Xfinity, then your own connection can't be trusted. They've been caught injecting messages in plaintext HTTP web pages.
- strogonoff 4y agoI may use a self-provisioned VPN, but actually this doesn’t matter. The point is that the user has no choice, regardless of circumstances. As an example (although it’s whataboutism), the option of using insecure SMS 2FA is routinely offered in much more sensitive contexts compared to the option of using plain HTTP to read static text content—yet the former is considered acceptable but the latter isn’t.