6 ms·

HTTP-only makes me weary of visiting a self-professed piracy site. They couldn't even spring for a Let's Encrypt cert?

by AdmiralAsshat 4y ago

quazar 4y ago
It's a read only blog with 2 pages. What do you gain for putting this over HTTPS?
- notriddle 4y ago
  The same thing you always get. Assurance that your free Wi-Fi hotspot isn’t tampering with the page.
  - krick 4y ago
    This, and also MITM (like ISP) needs to make their own request to this site, to know what I read. And, technically, they cannot really be sure it's what I've read, since nothing says that this site is static. I'm not that offended, and torrents are only available via TOR anyway, but I do actually appreciate the sentiment. There's no reason to be not using TLS.
- ac0lyte 4y ago
  Trust?
  - na85 4y ago
    Malicious sites can still use letsencrypt
- SquareWheel 4y ago
  Do you really want your ISP to know which piracy sites you frequent? This is all being sent in plain text. Or they could change the content, insert a redirect, or inject ads without your knowledge. TLS is needed on all websites - not just those with interaction.
  - ars 4y ago
    They still know which sites you visit even with https.
    - kenniskrag 4y ago
      only the destination IP. TLS encryption is inside tcp and around the http protocol.
      - hombre_fatal 4y ago
        You don’t need to copy and paste your reply everywhere it’s relevant on HN. Even us flea brains can carry your remarks in our head and apply them to similar comments.
      - geoffeg 4y ago
        And, unless you setup an appropriate DNS server and the default from your ISP, then they also know that you looked up the site's hostname(s).
    - pessimizer 4y ago
      They don't know the page. In the case of this site it probably doesn't matter, but which page you're looking at is always going to be more interesting and informative than which site you looked at. When the prosecutor is looking through your internet records and they see 50 wikipedia hits in some relevant time period, they're going to be upset that https exists.
  - generalizations 4y ago
    https won't keep your ISP from knowing you visited the site. And the rest of those? For a text-only blog, they seem kinda trivial.
    - robonerd 4y ago
      > For a text-only blog If somebody MITMs it, they can serve you anything they want.
1vuio0pswjnm7 4y ago
https://web.archive.org/web/20220701204054if_/http://pilimi.org/blog-introducing.html https://web.archive.org/web/20220701204054if_/http://pilimi....
mkl 4y ago
*wary For some reason I'm seeing this mistake more and more lately. https://en.wiktionary.org/wiki/weary https://en.wiktionary.org/wiki/weary vs https://en.wiktionary.org/wiki/wary https://en.wiktionary.org/wiki/wary
- InCityDreams 4y ago
  No room for auto-correct?
  - brewdad 4y ago
    Even so, there are enough ESL readers on here, along with native speakers who may not understand the difference, that it makes sense to point it out once in a while. Otherwise we end up in lose/loose situation where I see more people use it wrongly than correctly.
  - mkl 4y ago
    Seems unlikely, as "wary" appears to be the more common word (71M Google results vs 55M). Maybe some keyboard mistakenly does it though.
    - b112 4y ago
      Not sure why the count is relevant here. Both are valid words.
      - mkl 4y ago
        But automatically replacing a valid word with a less-common valid word that makes less sense in the context is not something predictive text should do.
        b112 4y ago
        You are presuming it was an automatic replacement. Some still type entire words via a thing called a keyboard, on a computer, others manually pick words to finish, from suggestions, not automatically. Beyond that, google searches are not indicative of current usage, in SMS/messages, emails, etc. Google search spans all webpages, and many text pre-web too.
superkuh 4y ago
HTTPS only via a CA (instead of self signing) is even worse for site of questional legality. Then it allows a centralized entity information and control of who can access your site. Yes, you can get a new TLS CA to sign your certs if one gets pressured to kick you out, but that just means the next will too.
jmprspret 4y ago
Use Tor to access the site then. There was a post here like a day or so ago about how Tor onion site operators were deanonymised due to their TLS certs for their clearnet mirrors.

HTTP-only makes me weary of visiting a self-professed piracy site. They couldn't even spring for a Let's Encrypt cert?

quazar 4y ago

It's a read only blog with 2 pages. What do you gain for putting this over HTTPS?

notriddle 4y ago
The same thing you always get. Assurance that your free Wi-Fi hotspot isn’t tampering with the page.
- krick 4y ago
  This, and also MITM (like ISP) needs to make their own request to this site, to know what I read. And, technically, they cannot really be sure it's what I've read, since nothing says that this site is static. I'm not that offended, and torrents are only available via TOR anyway, but I do actually appreciate the sentiment. There's no reason to be not using TLS.
ac0lyte 4y ago
Trust?
- na85 4y ago
  Malicious sites can still use letsencrypt
SquareWheel 4y ago
Do you really want your ISP to know which piracy sites you frequent? This is all being sent in plain text. Or they could change the content, insert a redirect, or inject ads without your knowledge. TLS is needed on all websites - not just those with interaction.
- ars 4y ago
  They still know which sites you visit even with https.
  - kenniskrag 4y ago
    only the destination IP. TLS encryption is inside tcp and around the http protocol.
    - hombre_fatal 4y ago
      You don’t need to copy and paste your reply everywhere it’s relevant on HN. Even us flea brains can carry your remarks in our head and apply them to similar comments.
    - geoffeg 4y ago
      And, unless you setup an appropriate DNS server and the default from your ISP, then they also know that you looked up the site's hostname(s).
  - pessimizer 4y ago
    They don't know the page. In the case of this site it probably doesn't matter, but which page you're looking at is always going to be more interesting and informative than which site you looked at. When the prosecutor is looking through your internet records and they see 50 wikipedia hits in some relevant time period, they're going to be upset that https exists.
- generalizations 4y ago
  https won't keep your ISP from knowing you visited the site. And the rest of those? For a text-only blog, they seem kinda trivial.
  - robonerd 4y ago
    > For a text-only blog If somebody MITMs it, they can serve you anything they want.

1vuio0pswjnm7 4y ago

https://web.archive.org/web/20220701204054if_/http://pilimi.org/blog-introducing.html https://web.archive.org/web/20220701204054if_/http://pilimi....

mkl 4y ago

*wary For some reason I'm seeing this mistake more and more lately. https://en.wiktionary.org/wiki/weary https://en.wiktionary.org/wiki/weary vs https://en.wiktionary.org/wiki/wary https://en.wiktionary.org/wiki/wary

InCityDreams 4y ago
No room for auto-correct?
- brewdad 4y ago
  Even so, there are enough ESL readers on here, along with native speakers who may not understand the difference, that it makes sense to point it out once in a while. Otherwise we end up in lose/loose situation where I see more people use it wrongly than correctly.
- mkl 4y ago
  Seems unlikely, as "wary" appears to be the more common word (71M Google results vs 55M). Maybe some keyboard mistakenly does it though.
  - b112 4y ago
    Not sure why the count is relevant here. Both are valid words.
    - mkl 4y ago
      But automatically replacing a valid word with a less-common valid word that makes less sense in the context is not something predictive text should do.
      - b112 4y ago
        You are presuming it was an automatic replacement. Some still type entire words via a thing called a keyboard, on a computer, others manually pick words to finish, from suggestions, not automatically. Beyond that, google searches are not indicative of current usage, in SMS/messages, emails, etc. Google search spans all webpages, and many text pre-web too.

superkuh 4y ago

HTTPS only via a CA (instead of self signing) is even worse for site of questional legality. Then it allows a centralized entity information and control of who can access your site. Yes, you can get a new TLS CA to sign your certs if one gets pressured to kick you out, but that just means the next will too.

jmprspret 4y ago

Use Tor to access the site then. There was a post here like a day or so ago about how Tor onion site operators were deanonymised due to their TLS certs for their clearnet mirrors.