5 ms·

> Now, think of what https really is for, what drove its adoption, and why the modern web needs it. And that's e-commerce! No, it's keeping the ISPs from spyin

by msla 4y ago

> Now, think of what https really is for, what drove its adoption, and why the modern web needs it. And that's e-commerce! No, it's keeping the ISPs from spying on, blocking, and adding advertising to any and all data they can get into. > Well, you achieve that simply by not putting private information on a public network. You have no idea what information will become sensitive in a few years. "If you're not doing anything wrong, you have nothing to hide" fails because I don't know what I'll eventually need to hide.

GuB-42 4y ago
TLS doesn't prevent blocking by ISPs, it is limited in term of spying prevention (metadata are still available), it does prevent tampering by ISPs, but I think that part would be more effectively achieved with digital signatures (ex: PGP blocks) that not only prevents tampering by ISPs, but also by someone who controls the server or by forgers. As for information you share that will become sensitive, yes sure, but if you think that, don't publish anything at all on public networks. But if you want a technical solution to still be able to post what you think is or may be sensitive in the future, then, TLS is probably not the right solution. Hacker News uses TLS for instance, and it won't help me at all if one of my comments gets me some unwanted attention, I am sure my username alone is enough to get back to me for someone with enough motivation.
- msla 4y ago
  > TLS doesn't prevent blocking by ISPs They can block it or they can let it through unmodified. They can't keyword-filter it and add advertisements to it. > it is limited in term of spying prevention (metadata are still available) Granted. However, "Your customer connected to this IP address" is much less marketable than "Your customer is reading information about stew recipes" and much less actionable than "Your customer is reading information about encryption and is therefore a traitor" and so on. > it does prevent tampering by ISPs, but I think that part would be more effectively achieved with digital signatures (ex: PGP blocks) that not only prevents tampering by ISPs, but also by someone who controls the server or by forgers. Digital signatures only guarantee that the data is from who it says it's from (which Gemini doesn't enforce because it specifies TOFU) and that hasn't been modified. They don't protect against spying, for advertising or any other reason. They also still rely on a cryptographic library, which undermines your point about how Gemini shouldn't be burdened with the complexity of TLS or SSL. > As for information you share that will become sensitive, yes sure, but if you think that, don't publish anything at all on public networks. Here, I'm not talking about what I post but what I access and read. It seems like you want to give everyone the ability to snoop on who uses the library and for what, and I have a hard time not attributing nasty motives to something like that.
ay 4y ago
two words: “Cambridge Analytica”. It all happened over TLS.
- msla 4y ago
  I'll keep that in mind when I connect to Facebook's Gemini servers.
  - ay 4y ago
    I used a household example. Try running pi-hole in your network if you don’t already. The amount of tracking and spying just about anywhere is astoundingly depressing. Transport encryption just shrinks the number of people at the party of eating the pie of your personal data. The pie still gets eaten, just by different people. And still without your consent. And absolutely nothing is done about it. The only tangible benefit I see from this “encryption everywhere” (which by the way mostly got triggered in the industry by Snowden files) is three letter agencies being forced to be more creative when dealing with mass-vacuumed data. Undeniably a good thing, but far from total hallelujah.
    - msla 4y ago
      We're talking about different threats. If a Gemini server I connect to somehow has tracking, yes, that will track me. However, the threat I'm talking about is ISPs tracking me, which TLS protects against. It's interesting that people seem to be unwilling to see that even as a topic, and keep veering off into other discussions.
      - ay 4y ago
        Maybe because it was a mostly theoretical problem for most of them. Could you supply some references about the issue which would document the ISPs tracking the users and selling their data ? I remember of only one case of some operator in the US injecting some html, which promptly caused a massive shitstorm and they stopped. In my ~30 years of internet use, I have never seen the ISP messing up my internet connection, other than the captive portals (which now simply block me when they expire). How big is really the problem we are paying all this worldwide complexity tax for ?

by msla 4y ago

GuB-42 4y ago

TLS doesn't prevent blocking by ISPs, it is limited in term of spying prevention (metadata are still available), it does prevent tampering by ISPs, but I think that part would be more effectively achieved with digital signatures (ex: PGP blocks) that not only prevents tampering by ISPs, but also by someone who controls the server or by forgers. As for information you share that will become sensitive, yes sure, but if you think that, don't publish anything at all on public networks. But if you want a technical solution to still be able to post what you think is or may be sensitive in the future, then, TLS is probably not the right solution. Hacker News uses TLS for instance, and it won't help me at all if one of my comments gets me some unwanted attention, I am sure my username alone is enough to get back to me for someone with enough motivation.

msla 4y ago
> TLS doesn't prevent blocking by ISPs They can block it or they can let it through unmodified. They can't keyword-filter it and add advertisements to it. > it is limited in term of spying prevention (metadata are still available) Granted. However, "Your customer connected to this IP address" is much less marketable than "Your customer is reading information about stew recipes" and much less actionable than "Your customer is reading information about encryption and is therefore a traitor" and so on. > it does prevent tampering by ISPs, but I think that part would be more effectively achieved with digital signatures (ex: PGP blocks) that not only prevents tampering by ISPs, but also by someone who controls the server or by forgers. Digital signatures only guarantee that the data is from who it says it's from (which Gemini doesn't enforce because it specifies TOFU) and that hasn't been modified. They don't protect against spying, for advertising or any other reason. They also still rely on a cryptographic library, which undermines your point about how Gemini shouldn't be burdened with the complexity of TLS or SSL. > As for information you share that will become sensitive, yes sure, but if you think that, don't publish anything at all on public networks. Here, I'm not talking about what I post but what I access and read. It seems like you want to give everyone the ability to snoop on who uses the library and for what, and I have a hard time not attributing nasty motives to something like that.

ay 4y ago

two words: “Cambridge Analytica”. It all happened over TLS.

msla 4y ago
I'll keep that in mind when I connect to Facebook's Gemini servers.
- ay 4y ago
  I used a household example. Try running pi-hole in your network if you don’t already. The amount of tracking and spying just about anywhere is astoundingly depressing. Transport encryption just shrinks the number of people at the party of eating the pie of your personal data. The pie still gets eaten, just by different people. And still without your consent. And absolutely nothing is done about it. The only tangible benefit I see from this “encryption everywhere” (which by the way mostly got triggered in the industry by Snowden files) is three letter agencies being forced to be more creative when dealing with mass-vacuumed data. Undeniably a good thing, but far from total hallelujah.
  - msla 4y ago
    We're talking about different threats. If a Gemini server I connect to somehow has tracking, yes, that will track me. However, the threat I'm talking about is ISPs tracking me, which TLS protects against. It's interesting that people seem to be unwilling to see that even as a topic, and keep veering off into other discussions.
    - ay 4y ago
      Maybe because it was a mostly theoretical problem for most of them. Could you supply some references about the issue which would document the ISPs tracking the users and selling their data ? I remember of only one case of some operator in the US injecting some html, which promptly caused a massive shitstorm and they stopped. In my ~30 years of internet use, I have never seen the ISP messing up my internet connection, other than the captive portals (which now simply block me when they expire). How big is really the problem we are paying all this worldwide complexity tax for ?