5 ms·

> HTTPS protects people from ISP-based MITM attacks On the infinite list things to worry about, "ISP-based MITM attacks" ranks somewhere around "getting bitten

> HTTPS protects people from ISP-based MITM attacks On the infinite list things to worry about, "ISP-based MITM attacks" ranks somewhere around "getting bitten by a shark while fighting a velociraptor" and "accidentally getting abducted by a UFO". Please, please, let's start solving real problems. P.S. I know about dishonest ISP's that try to inject ads into pages. Switch to a better ISP, problem solved.

xurukefi 4y ago
> Switch to a better ISP, problem solved. There are a lot of people in this world who can choose between exactly one ISP.
- otabdeveloper4 4y ago
  There are a lot of people who can choose between exactly one supermarket. Should you equip everyone in the world with an e-coli tester? You know, it's super-easy for a supermarket employee to infect your food with e-coli! Some problems don't need a technical solution, okay?
  - paledot 4y ago
    In 2022, the strongest possible argument against using HTTPS is "it's not strictly necessary". That's it. It's not expensive, it's not hard, it's not slow. The worst case is you've done something unnecessary for most people (arguably). Yeah, if "e-coli testers" were free, easy to distribute, and consumed no resources, including them with every supermarket purchase would be a great idea.
    - Rudism 4y ago
      Also if it has been proven that, given a chance, many supermarkets have and still actively do inject e-coli into their foods because they are able to profit off of it somehow, then the "e-coli testers" would be an even better idea.
- deleted 4y ago
  [deleted]
dmantis 4y ago
That might be very new information, but there are 195 countries in the world (194 apart from yours!) with plenty of them forcing internet censorship or gov espionage. I'm kinda happy that the worst scenario in yours are internet ads, but you can't say that if your country don't force providers to inject fake pages for selective pages, there is not need to protect traffic for the whole world. And no, you can't switch ISP in the case if the hacking comes from gov censorship agencies.
- otabdeveloper4 4y ago
  You must be a theoretician, because people who actually have to deal with censorship know that government entities mandate certificate MITM or block domains whole-sale. So https does nothing for censorship unless you're worried about the absolutely unrealistic case of a government entity running search-and-replace on your webpage content at the ISP level. (Unrealistic because they can just send a legal order to whoever is hosting this content instead.)
  - dmantis 4y ago
    I'm a holder of Russian passport, so no, I'm not a theoretician. 1) They block the whole-domain only in case of https which reminds you to turn-on the VPN. In case of http you could just have something like 404 response for particular page and you would never know that it's actually not 404, but ISP block (depends on ISP and DPI). So still https is preferable to be able to distinguish between two types of blocks. 2) They don't do "replace" in general, true, but for opposition resources they might be creative. 3) Most of hosters and content providers (if they don't have legal presence in Ru) don't care about legal orders from Russia (as well as from other third-world dictatorship regimes) until it's some real valid stuff to complain about.

xurukefi 4y ago

> Switch to a better ISP, problem solved. There are a lot of people in this world who can choose between exactly one ISP.

otabdeveloper4 4y ago
There are a lot of people who can choose between exactly one supermarket. Should you equip everyone in the world with an e-coli tester? You know, it's super-easy for a supermarket employee to infect your food with e-coli! Some problems don't need a technical solution, okay?
- paledot 4y ago
  In 2022, the strongest possible argument against using HTTPS is "it's not strictly necessary". That's it. It's not expensive, it's not hard, it's not slow. The worst case is you've done something unnecessary for most people (arguably). Yeah, if "e-coli testers" were free, easy to distribute, and consumed no resources, including them with every supermarket purchase would be a great idea.
  - Rudism 4y ago
    Also if it has been proven that, given a chance, many supermarkets have and still actively do inject e-coli into their foods because they are able to profit off of it somehow, then the "e-coli testers" would be an even better idea.
deleted 4y ago
[deleted]

dmantis 4y ago

That might be very new information, but there are 195 countries in the world (194 apart from yours!) with plenty of them forcing internet censorship or gov espionage. I'm kinda happy that the worst scenario in yours are internet ads, but you can't say that if your country don't force providers to inject fake pages for selective pages, there is not need to protect traffic for the whole world. And no, you can't switch ISP in the case if the hacking comes from gov censorship agencies.

otabdeveloper4 4y ago
You must be a theoretician, because people who actually have to deal with censorship know that government entities mandate certificate MITM or block domains whole-sale. So https does nothing for censorship unless you're worried about the absolutely unrealistic case of a government entity running search-and-replace on your webpage content at the ISP level. (Unrealistic because they can just send a legal order to whoever is hosting this content instead.)
- dmantis 4y ago
  I'm a holder of Russian passport, so no, I'm not a theoretician. 1) They block the whole-domain only in case of https which reminds you to turn-on the VPN. In case of http you could just have something like 404 response for particular page and you would never know that it's actually not 404, but ISP block (depends on ISP and DPI). So still https is preferable to be able to distinguish between two types of blocks. 2) They don't do "replace" in general, true, but for opposition resources they might be creative. 3) Most of hosters and content providers (if they don't have legal presence in Ru) don't care about legal orders from Russia (as well as from other third-world dictatorship regimes) until it's some real valid stuff to complain about.