37 ms·

Having personally experienced what happens to my webpages when Comcast realizes that it can do whatever it wants to bare HTTP requests all the way up to and inc

by saulrh 3y ago

Having personally experienced what happens to my webpages when Comcast realizes that it can do whatever it wants to bare HTTP requests all the way up to and including inserting invasive advertisements loaded with arbitrary javascript, I think that "least worst" is exactly the right word for requiring HTTPS everywhere. I do agree that it would have been nice if there was a standard that required encryption without also requiring authentication, but this is the world we live in now.

johncolanduoni 3y ago
If it didn't require authentication, Comcast could just MITM you.
- saulrh 3y ago
  Right, I knew I was forgetting something about that. Yeaaaaaah. And speaking of that, let's not forget about downgrade attacks! Removing HTTP is the least worst option in much the same way that you disallow RC4 when negotiating encryption for an SSH connection.
superkuh 3y ago
I also had Comcast do that. It made my Steam (games service) browser un-usable one time. So in commercial contexts HTTPS makes sense. But there is more to the web than just the commercial, institutional, and the like. Websites that are run by human people without profit motive and without any need to be constrained by the realities of CA TLS exist. The major browsers are all about money these days so they'll prioritize the safety of monetary transactions above user freedoms. But just because this is the right decision for an profit driven company or institution doesn't mean it's the right thing for everyone and should be applied to everyone. In fact doing so will ruin the web.
- saulrh 3y ago
  With advertising eyeballs and third parties in the loop there is nothing that is not "commercial". Do you think that Comcast would have refrained from injecting ads and attack scripts if you'd been browsing Wikipedia or the Internet Archive or your own personal blog instead of Steam? Do you think that they'd have gotten less money for those impressions or extracted less of your personal data? The use case doesn't matter because the attackers in the HTTP vs HTTPS case have their own monetization scheme and their own attack chain and they _do not care_ whether something is commercial or private.
  - superkuh 3y ago
    Nearly all commercial services require the execution of javascript. For example, I couldn't disable javascript in my Steam browser. But in my personal browsers I have javascript execution set to temporary-whitelist-only. Much like how I don't open and execute every email attachment sent to me. Comcast's injection attacks actually don't do anything without JS being run. I am not being hyperbolic in saying that 100% of malicious attacks on the web of the type you're floating use javascript and fail without it. Personal and non-profit (non-incorporated) websites are mostly static html and files in directories and do not require everything everywhere be encrypted and verified. This "execute everything blindly" practice is only accepted because it's required for businesses which require JS execution. I reject this premise because no, it doesn't apply in all contexts and risks of MITM attacks (on personal websites) are very low once you question and mitigate it. The document web is much safer and requires less sacrifices than the application web.

by saulrh 3y ago

johncolanduoni 3y ago

If it didn't require authentication, Comcast could just MITM you.

saulrh 3y ago
Right, I knew I was forgetting something about that. Yeaaaaaah. And speaking of that, let's not forget about downgrade attacks! Removing HTTP is the least worst option in much the same way that you disallow RC4 when negotiating encryption for an SSH connection.

superkuh 3y ago

I also had Comcast do that. It made my Steam (games service) browser un-usable one time. So in commercial contexts HTTPS makes sense. But there is more to the web than just the commercial, institutional, and the like. Websites that are run by human people without profit motive and without any need to be constrained by the realities of CA TLS exist. The major browsers are all about money these days so they'll prioritize the safety of monetary transactions above user freedoms. But just because this is the right decision for an profit driven company or institution doesn't mean it's the right thing for everyone and should be applied to everyone. In fact doing so will ruin the web.

saulrh 3y ago
With advertising eyeballs and third parties in the loop there is nothing that is not "commercial". Do you think that Comcast would have refrained from injecting ads and attack scripts if you'd been browsing Wikipedia or the Internet Archive or your own personal blog instead of Steam? Do you think that they'd have gotten less money for those impressions or extracted less of your personal data? The use case doesn't matter because the attackers in the HTTP vs HTTPS case have their own monetization scheme and their own attack chain and they _do not care_ whether something is commercial or private.
- superkuh 3y ago
  Nearly all commercial services require the execution of javascript. For example, I couldn't disable javascript in my Steam browser. But in my personal browsers I have javascript execution set to temporary-whitelist-only. Much like how I don't open and execute every email attachment sent to me. Comcast's injection attacks actually don't do anything without JS being run. I am not being hyperbolic in saying that 100% of malicious attacks on the web of the type you're floating use javascript and fail without it. Personal and non-profit (non-incorporated) websites are mostly static html and files in directories and do not require everything everywhere be encrypted and verified. This "execute everything blindly" practice is only accepted because it's required for businesses which require JS execution. I reject this premise because no, it doesn't apply in all contexts and risks of MITM attacks (on personal websites) are very low once you question and mitigate it. The document web is much safer and requires less sacrifices than the application web.