2 ms·

"Private chat with the devil" is the perfect security model for most web sessions. I trust very few websites I visit in any real sense.

woodruffw 3y ago
> "Private chat with the devil" is the perfect security model for most web sessions. I trust very few websites I visit in any real sense. I'm sorry, but this is either incorrect or a gross misunderstanding of your own threat model. Most people treat their online self as an extension of their physical self: that means banking information, private personal details, intimate communications, and everything else that's normally private by virtue of physical ownership needs to go through an authenticated channel. You might not care that someone can't MITM your Wikipedia traffic, but you almost certainly care that someone can't MITM your tax returns or your medical records.
- recursive 3y ago
  > You might not care that someone can't MITM your Wikipedia traffic, but you almost certainly care that someone can't MITM your tax returns or your medical records. So presumably, you'd demand a cert from a trustworthy authority in those cases. But you still don't want your ISP to be able to inject ads into the recipe blog you're reading.
  - donaldstufft 3y ago
    With self signed certificates your ISP can just serve their own self signed certificate, and then inject ads into the recipe blog.
- bandrami 3y ago
  And I definitely want 3rd party verification for my tax preparation website. But I don't trust news.ycombinator.com any more than I trust somebody pretending to be news.ycombinator.com; validating that cert does nothing useful for me.
  - woodruffw 3y ago
    > But I don't trust news.ycombinator.com any more than I trust somebody pretending to be news.ycombinator.com; validating that cert does nothing useful for me. Yes, you absolutely do. You don't expect news.ycombinator.com to serve you malicious JavaScript, or to redirect you to porn, or to do anything other than serve churlish content from the Internet commentariat.
    - bandrami 3y ago
      > You don't expect news.ycombinator.com to serve you malicious JavaScript I absolutely do not trust this site (or most sites) enough to run arbitrary javascript it serves.

woodruffw 3y ago

> "Private chat with the devil" is the perfect security model for most web sessions. I trust very few websites I visit in any real sense. I'm sorry, but this is either incorrect or a gross misunderstanding of your own threat model. Most people treat their online self as an extension of their physical self: that means banking information, private personal details, intimate communications, and everything else that's normally private by virtue of physical ownership needs to go through an authenticated channel. You might not care that someone can't MITM your Wikipedia traffic, but you almost certainly care that someone can't MITM your tax returns or your medical records.

recursive 3y ago
> You might not care that someone can't MITM your Wikipedia traffic, but you almost certainly care that someone can't MITM your tax returns or your medical records. So presumably, you'd demand a cert from a trustworthy authority in those cases. But you still don't want your ISP to be able to inject ads into the recipe blog you're reading.
- donaldstufft 3y ago
  With self signed certificates your ISP can just serve their own self signed certificate, and then inject ads into the recipe blog.
bandrami 3y ago
And I definitely want 3rd party verification for my tax preparation website. But I don't trust news.ycombinator.com any more than I trust somebody pretending to be news.ycombinator.com; validating that cert does nothing useful for me.
- woodruffw 3y ago
  > But I don't trust news.ycombinator.com any more than I trust somebody pretending to be news.ycombinator.com; validating that cert does nothing useful for me. Yes, you absolutely do. You don't expect news.ycombinator.com to serve you malicious JavaScript, or to redirect you to porn, or to do anything other than serve churlish content from the Internet commentariat.
  - bandrami 3y ago
    > You don't expect news.ycombinator.com to serve you malicious JavaScript I absolutely do not trust this site (or most sites) enough to run arbitrary javascript it serves.