3 ms·
Visiting a single unencrypted website allows anyone who controls the connection (your government/ISP/WiFi provider) to cause your browser to silently execute ma
by shaicoleman 4y ago
Visiting a single unencrypted website allows anyone who controls the connection (your government/ISP/WiFi provider) to cause your browser to silently execute malicious code and download malicious content. Compromising the security of 99.9% of users for the benefit of the 0.1% isn't even remotely worth it. Those 0.1% also have a simple workaround of using a proxy if needed.
- marginalia_nu 4y agoSeems like a browser issue, not a website issue.
- LunaSea 4y agoBrowser's can't verify the integrity of website contents.
- marginalia_nu 4y agoHTTPS can't verify that either, to be quite honest. It can ensure modest protection against a specific class of MITM attacks. If the traffic goes through a CDN like cloudflares it's decrypted, inspected, possibly manipulated and re-encrypted mid-flight. A well funded actor can also lean on the website owner, or just hack them.
- LunaSea 4y agoTLS protects completely against network based MitM attacks. CDNs are purposefully installed in MitM positions. That's a risk that the sites owner has to manage and it's an optional one at that. A well funded actor would probably use different kind of vectors and not even bother with website MitM.
- marginalia_nu 4y agoSo why does catmemes.lol need to be encrypted with such urgency?
- LunaSea 4y agoBecause random ISPs will inject ads in websites for example.
- marginalia_nu 4y agoThat seems like a poor choice of ISP to me. If I dial my phone and have to listen to ad jingles before it connects, I'm changing my phone company.
- TingPing 4y agoThat type of response comes from a place of privilege. Many have no choice over ISP.
- marginalia_nu 4y agoDysfunctional markets is a legal problem, not a technical one. Concealing the consequences of market dysfunction with technological band-aids only serves to preserve the status quo.
- TingPing 4y agoThis is just a deeply unhelpful way to think. Firstly it punishes those in the worst situations. Those in countries with abusive political systems, those who have no legal representation, etc. I don't even believe the idea is right in practice "serves to preserve the status quo" is just wrong in this case. HTTPS completely breaks most terrible things ISPs can do. It completely dismantles the system.
- marginalia_nu 4y ago
- shaicoleman 4y ago> Seems like a browser issue, not a website issue. That's why Mozilla and Google have been working on the transition to HTTPS for years. Mozilla announced deprecating HTTP back in Apr/2015 [1], to allow plenty of time for everyone to upgrade. 1. https://blog.mozilla.org/security/2015/04/30/deprecating-non-secure-http/ https://blog.mozilla.org/security/2015/04/30/deprecating-non...
- marginalia_nu 4y agoRight, but if the security threat is the browser silently executing malicious code, shouldn't that be the fix, rather than the protocol? HTTP data itself isn't harmful.
- shaicoleman 4y agoJavaScript code can be malicious, even while sandboxed (e.g. downloading a file). There are still dozens of browser security issues found and fixed every month. A simple HTTP redirect to download a PDF file can also lead compromising the user's computer.
- marginalia_nu 4y agoHow does HTTPS protect from any of that? PDFs can still compromise your computer, and JS is still sketchy. Anyone can encrypt their server, even the bad guys.
- shaicoleman 4y agoThat only happens if you directly visit a malicious site, e.g. https://secure.mybaaankingsite.com https://secure.mybaaankingsite.com You can protect yourself by going directly to the URL and checking you're on the right domain. If you don't enforce HTTPS everywhere, any website is potentially malicious, e.g. visiting http://cookierecipes.com http://cookierecipes.com can have the same consequences.
- 4y ago
- throwaway290 4y ago> to cause your browser to silently execute malicious code and download malicious content You are making assumptions about my user agent. If you use insecure JS-executing browsers and problematic ISPs (I know not everyone has a choice), consider VPN or an extension that forces HTTPS.