3 ms·

> Seems like a browser issue, not a website issue. That's why Mozilla and Google have been working on the transition to HTTPS for years. Mozilla announced dep

> Seems like a browser issue, not a website issue. That's why Mozilla and Google have been working on the transition to HTTPS for years. Mozilla announced deprecating HTTP back in Apr/2015 [1], to allow plenty of time for everyone to upgrade. 1. https://blog.mozilla.org/security/2015/04/30/deprecating-non-secure-http/ https://blog.mozilla.org/security/2015/04/30/deprecating-non...

marginalia_nu 4y ago
Right, but if the security threat is the browser silently executing malicious code, shouldn't that be the fix, rather than the protocol? HTTP data itself isn't harmful.
- shaicoleman 4y ago
  JavaScript code can be malicious, even while sandboxed (e.g. downloading a file). There are still dozens of browser security issues found and fixed every month. A simple HTTP redirect to download a PDF file can also lead compromising the user's computer.
  - marginalia_nu 4y ago
    How does HTTPS protect from any of that? PDFs can still compromise your computer, and JS is still sketchy. Anyone can encrypt their server, even the bad guys.
    - shaicoleman 4y ago
      That only happens if you directly visit a malicious site, e.g. https://secure.mybaaankingsite.com https://secure.mybaaankingsite.com You can protect yourself by going directly to the URL and checking you're on the right domain. If you don't enforce HTTPS everywhere, any website is potentially malicious, e.g. visiting http://cookierecipes.com http://cookierecipes.com can have the same consequences.
      - marginalia_nu 4y ago
        Right, but how do I know whether the URL pattern is legitimate? I don't work for the IT department at my bank. If the answer is to just eyeball it, that does seem like a far worse security problem than HTTP has ever been.
        shaicoleman 4y ago
        HTTPS isn't a panacea for all security issues. It ensures that when you connect to website.com, you'll get whatever website.com sends to you, without anyone else eavesdropping and tampering with the connection. HTTPS doesn't prevent you from going to weebsite.com. There are other security measures for that, but it's also your responsibility to check.
        marginalia_nu 4y ago
        It doesn't even do the first thing. There are multiple vectors where someone could tamper or eavesdrop on a HTTPS connection, perhaps the biggest one being CDNs. As a visitor, you have no real idea how secure the connection is, even if it has a "padlock". HTTPS offers some protection against local attack vectors, from your ISP or on a public WiFi, but that's about it. The server could be compromised, or malicious, you have no idea. Putting the responsibility for checking the rest on the user is honestly a mistake. They could be dyslexic, and may not be able to detect a typo. They could also be 85 years old and not understand half of what you are saying. These are the problems browsers should be focusing on. Security is not as easy as encrypting the protocol and saying everything else is user error.
        TingPing 4y ago
        You keep sidestepping the benefits. You want website.com you get website.com. It's impossible to know the infrastructure of that website and simply isn't something HTTPS will fix. That's more of a social/legal problem of how companies can handle user data.
        4y ago

marginalia_nu 4y ago

Right, but if the security threat is the browser silently executing malicious code, shouldn't that be the fix, rather than the protocol? HTTP data itself isn't harmful.

shaicoleman 4y ago
JavaScript code can be malicious, even while sandboxed (e.g. downloading a file). There are still dozens of browser security issues found and fixed every month. A simple HTTP redirect to download a PDF file can also lead compromising the user's computer.
- marginalia_nu 4y ago
  How does HTTPS protect from any of that? PDFs can still compromise your computer, and JS is still sketchy. Anyone can encrypt their server, even the bad guys.
  - shaicoleman 4y ago
    That only happens if you directly visit a malicious site, e.g. https://secure.mybaaankingsite.com https://secure.mybaaankingsite.com You can protect yourself by going directly to the URL and checking you're on the right domain. If you don't enforce HTTPS everywhere, any website is potentially malicious, e.g. visiting http://cookierecipes.com http://cookierecipes.com can have the same consequences.
    - marginalia_nu 4y ago
      Right, but how do I know whether the URL pattern is legitimate? I don't work for the IT department at my bank. If the answer is to just eyeball it, that does seem like a far worse security problem than HTTP has ever been.
      - shaicoleman 4y ago
        HTTPS isn't a panacea for all security issues. It ensures that when you connect to website.com, you'll get whatever website.com sends to you, without anyone else eavesdropping and tampering with the connection. HTTPS doesn't prevent you from going to weebsite.com. There are other security measures for that, but it's also your responsibility to check.
        marginalia_nu 4y ago
        It doesn't even do the first thing. There are multiple vectors where someone could tamper or eavesdrop on a HTTPS connection, perhaps the biggest one being CDNs. As a visitor, you have no real idea how secure the connection is, even if it has a "padlock". HTTPS offers some protection against local attack vectors, from your ISP or on a public WiFi, but that's about it. The server could be compromised, or malicious, you have no idea. Putting the responsibility for checking the rest on the user is honestly a mistake. They could be dyslexic, and may not be able to detect a typo. They could also be 85 years old and not understand half of what you are saying. These are the problems browsers should be focusing on. Security is not as easy as encrypting the protocol and saying everything else is user error.
        TingPing 4y ago
        You keep sidestepping the benefits. You want website.com you get website.com. It's impossible to know the infrastructure of that website and simply isn't something HTTPS will fix. That's more of a social/legal problem of how companies can handle user data.
        4y ago