4 ms·

Why is the submission URL using http instead of https? That just seems... bizarre.

CharlesW 4y ago
https://blog.cr.yp.to/20220805-nsa.html https://blog.cr.yp.to/20220805-nsa.html works too.
effie 4y ago
Why? Http is simpler, less fragile, not dependent on good will of third parties, the content is public, and proving authenticity of text on Internet is always hard, even when served via the https scheme. I bet Bernstein thinks there is little point in forcing people to use https to read his page.
- z9znz 4y ago
  MITM could change what the client receives, right?
  - effie 4y ago
    Yes. But if you worry about being a target for MITM attacks, https alone does not fix that problem. You need some reliable verification mechanism that is hard to fool. The current CA system or "trust on first use" are only partial, imperfect mechanisms.
- oittaa 4y ago
  That's just wrong on so many levels. Troy Hunt has an excellent explanation: https://www.troyhunt.com/heres-why-your-static-website-needs-https/ https://www.troyhunt.com/heres-why-your-static-website-needs...
  - effie 4y ago
    Troy Hunt points out that HTTP traffic is sometimes MITMed in a way that clients and servers do not like, and HTTPS sometimes prevents that. I never said otherwise. I am saying for certain kinds of pages, it's not a major concern. Like for djb website. Why not use HTTPS for everything? Because it also has costs, not just benefits.
    - oittaa 4y ago
      > Because it also has costs, not just benefits. That's not really true. Certificates have been free for a long time and every CPU made within the last 10 years has AES acceleration. You can google white papers from companies like Cloudflare and Google, which actually show speedups with HTTP 2 or 3.
      - effie 4y ago
        There are other costs, with deployment and maintenance. Well built HTTP site works on its own until browsers intentionally stop accepting it. HTTPS site works for few months and then a new certificate needs to be obtained and deployed. This has real cost in additional risk of outages, support requests, and not the least, becoming dependent on the goodwill of the certificate issuer.
msk20 4y ago
Just FYI, On my Firefox its saying "Connection Secure (upgraded to https)", its actually using ECDHE CHACHA20 SHA256. Note: I have "Enable HTTPS-Only Mode in all windows" on by default.
sdwr 4y ago
Cryptography experts know when to care about security. Cryptography enthusiasts try to slap encryption on everything.
deleted 4y ago
[deleted]

https://blog.cr.yp.to/20220805-nsa.html https://blog.cr.yp.to/20220805-nsa.html works too.

Why? Http is simpler, less fragile, not dependent on good will of third parties, the content is public, and proving authenticity of text on Internet is always hard, even when served via the https scheme. I bet Bernstein thinks there is little point in forcing people to use https to read his page.

z9znz 4y ago
MITM could change what the client receives, right?
- effie 4y ago
  Yes. But if you worry about being a target for MITM attacks, https alone does not fix that problem. You need some reliable verification mechanism that is hard to fool. The current CA system or "trust on first use" are only partial, imperfect mechanisms.
oittaa 4y ago
That's just wrong on so many levels. Troy Hunt has an excellent explanation: https://www.troyhunt.com/heres-why-your-static-website-needs-https/ https://www.troyhunt.com/heres-why-your-static-website-needs...
- effie 4y ago
  Troy Hunt points out that HTTP traffic is sometimes MITMed in a way that clients and servers do not like, and HTTPS sometimes prevents that. I never said otherwise. I am saying for certain kinds of pages, it's not a major concern. Like for djb website. Why not use HTTPS for everything? Because it also has costs, not just benefits.
  - oittaa 4y ago
    > Because it also has costs, not just benefits. That's not really true. Certificates have been free for a long time and every CPU made within the last 10 years has AES acceleration. You can google white papers from companies like Cloudflare and Google, which actually show speedups with HTTP 2 or 3.
    - effie 4y ago
      There are other costs, with deployment and maintenance. Well built HTTP site works on its own until browsers intentionally stop accepting it. HTTPS site works for few months and then a new certificate needs to be obtained and deployed. This has real cost in additional risk of outages, support requests, and not the least, becoming dependent on the goodwill of the certificate issuer.

msk20 4y ago

Just FYI, On my Firefox its saying "Connection Secure (upgraded to https)", its actually using ECDHE CHACHA20 SHA256. Note: I have "Enable HTTPS-Only Mode in all windows" on by default.

sdwr 4y ago

Cryptography experts know when to care about security. Cryptography enthusiasts try to slap encryption on everything.

deleted 4y ago

[deleted]