4 ms·

Browser's can't verify the integrity of website contents.

marginalia_nu 4y ago
HTTPS can't verify that either, to be quite honest. It can ensure modest protection against a specific class of MITM attacks. If the traffic goes through a CDN like cloudflares it's decrypted, inspected, possibly manipulated and re-encrypted mid-flight. A well funded actor can also lean on the website owner, or just hack them.
- LunaSea 4y ago
  TLS protects completely against network based MitM attacks. CDNs are purposefully installed in MitM positions. That's a risk that the sites owner has to manage and it's an optional one at that. A well funded actor would probably use different kind of vectors and not even bother with website MitM.
  - marginalia_nu 4y ago
    So why does catmemes.lol need to be encrypted with such urgency?
    - LunaSea 4y ago
      Because random ISPs will inject ads in websites for example.
      - marginalia_nu 4y ago
        That seems like a poor choice of ISP to me. If I dial my phone and have to listen to ad jingles before it connects, I'm changing my phone company.
        TingPing 4y ago
        That type of response comes from a place of privilege. Many have no choice over ISP.
        marginalia_nu 4y ago
        Dysfunctional markets is a legal problem, not a technical one. Concealing the consequences of market dysfunction with technological band-aids only serves to preserve the status quo.
        TingPing 4y ago
        This is just a deeply unhelpful way to think. Firstly it punishes those in the worst situations. Those in countries with abusive political systems, those who have no legal representation, etc. I don't even believe the idea is right in practice "serves to preserve the status quo" is just wrong in this case. HTTPS completely breaks most terrible things ISPs can do. It completely dismantles the system.
        marginalia_nu 4y ago
        > Firstly it punishes those in the worst situations. Those in countries with abusive political systems, those who have no legal representation, etc. HTTPS offers virtually no defense against a state actor. > I don't even believe the idea is right in practice "serves to preserve the status quo" is just wrong in this case. HTTPS completely breaks most terrible things ISPs can do. It completely dismantles the system. HTTPS doesn't dismantle the system at all. You're still stuck with no other option for an ISP, which means you are not going to get favorable terms. And even with HTTPS, you need to look up the IP for the servers you're going to visit, and ISPs can snoop on your DNS traffic and sell information about how you, the IP (or the person), regularly looks up the IP for abortionpills.example.com (or connects to the IP associated with the server).
        TingPing 4y ago

HTTPS can't verify that either, to be quite honest. It can ensure modest protection against a specific class of MITM attacks. If the traffic goes through a CDN like cloudflares it's decrypted, inspected, possibly manipulated and re-encrypted mid-flight. A well funded actor can also lean on the website owner, or just hack them.

LunaSea 4y ago
TLS protects completely against network based MitM attacks. CDNs are purposefully installed in MitM positions. That's a risk that the sites owner has to manage and it's an optional one at that. A well funded actor would probably use different kind of vectors and not even bother with website MitM.
- marginalia_nu 4y ago
  So why does catmemes.lol need to be encrypted with such urgency?
  - LunaSea 4y ago
    Because random ISPs will inject ads in websites for example.
    - marginalia_nu 4y ago
      That seems like a poor choice of ISP to me. If I dial my phone and have to listen to ad jingles before it connects, I'm changing my phone company.
      - TingPing 4y ago
        That type of response comes from a place of privilege. Many have no choice over ISP.
        marginalia_nu 4y ago
        Dysfunctional markets is a legal problem, not a technical one. Concealing the consequences of market dysfunction with technological band-aids only serves to preserve the status quo.
        TingPing 4y ago
        This is just a deeply unhelpful way to think. Firstly it punishes those in the worst situations. Those in countries with abusive political systems, those who have no legal representation, etc. I don't even believe the idea is right in practice "serves to preserve the status quo" is just wrong in this case. HTTPS completely breaks most terrible things ISPs can do. It completely dismantles the system.
        marginalia_nu 4y ago
        > Firstly it punishes those in the worst situations. Those in countries with abusive political systems, those who have no legal representation, etc. HTTPS offers virtually no defense against a state actor. > I don't even believe the idea is right in practice "serves to preserve the status quo" is just wrong in this case. HTTPS completely breaks most terrible things ISPs can do. It completely dismantles the system. HTTPS doesn't dismantle the system at all. You're still stuck with no other option for an ISP, which means you are not going to get favorable terms. And even with HTTPS, you need to look up the IP for the servers you're going to visit, and ISPs can snoop on your DNS traffic and sell information about how you, the IP (or the person), regularly looks up the IP for abortionpills.example.com (or connects to the IP associated with the server).
        TingPing 4y ago