5 ms·

I'm always baffled by people arguing that we shouldn't use HTTPS. Have these people forgotten the times when mobile providers would "optimize" images (=compress

I'm always baffled by people arguing that we shouldn't use HTTPS. Have these people forgotten the times when mobile providers would "optimize" images (=compress them to death) or even insert advertisements? Or the times when simply being on the same network as someone with alterior motives could lead to your credentials being stolen? I get it, certificates are hard, but having free certificates by Letsencrypt has probably been one of the most beneficial things that happened to the Internet in the last 10 years. If someone doesn't like it, please put in the work to come up with a better solution, not arguing for an even worse solution. The author of this article doesn't propose anything workable. Mentioning SSH is ridiculous, it's not meant to access servers you don't know. Also, I have seen more than a few sysadmins who would easily be tripped up by a MITM because they'd just wipe their know hosts file at the first sign of trouble. And these are TRAINED people.

lolive 3y ago
LetsEncrypt is FANTASTIC !
eatbitseveryday 3y ago
I think you're conflating two things. Protecting against modification of data in-transit can be done without encryption. Signing the clear-text content allows the receiver to verify if the data is original. Encrypting hides the content from middle parties.
- janosdebugs 3y ago
  In the age of interest-based advertising is it really reasonable to suggest that we should let our network provider see every single website and subpage we visit?
  - checkyoursudo 3y ago
    This is really my problem with the "don't encrypt anything static" argument. I don't encrypt for security (or at least not primarily; I am not under the illusion that encryption makes my data unassailable) but for privacy. There is a big difference between every jump between me and example.com seeing "example.com" or "example.com/so-you-think-you-might-be-heading-for-divorce.html" (just an example; I am happily married, in case my wife ever sees this).
- lolinder 3y ago
  Signing clear-text content requires only slightly less infrastructure than encrypting it, for a less useful result. I don't want every party in between me and the destination server to be able to see the contents of my HTTP requests, even for static pages. HTTPS is what makes the difference between an ISP being able to see that Alice is on WebMD and an ISP being able to see that Alice thinks she has a specific embarrassing illness.
  - janosdebugs 3y ago
    Or even worse, Alice was just curious because of a conversation that happened and now her advertising profile will mark her as an insurance risk.
andrewmcwatters 3y ago
That's not what the article is suggesting.
- janosdebugs 3y ago
  > My medical opinion: if it hurts, maybe you should stop doing it. Which part of this is not suggesting we should stop using HTTPS?
  - JohnFen 3y ago
    I interpreted that as meaning stop using LE, not stop using HTTPS. But in context, I see it can be reasonably interpreted either way.
    - janosdebugs 3y ago
      It doesn't matter which CA one is using as long as there is a CA that's freely available to anyone. The article makes very questionable suggestions such as this: > For decades, users of SSH have had a system (save the certificate permanently the first time you connect, and warn if it ever changes) that is optimal in a sense: it works at least as well as any other solution. It's trivial to implement, is completely free, involves no third parties, and lasts forever. To the surprise of absolutely no one, web browsers don't support it. I would interpret this as the author arguing against the entire CA system.
devmor 3y ago
The days of plain HTTP were amazing, from the point of view of a teenage hacker that hung out at the public library of a college town. At one point when Facebook started becoming popular, I had a script on my laptop that would grab session cookies from other people on the network and post things to the victims' facebook status like "I'm using unsecured wifi at the public library and I like to sniff butts"! Learning that stuff taught me a lot about network security, and left me with a wariness of trusting networks that I don't control that I still keep close to heart long into my career.
- ip_addr 3y ago
  The days of Firesheep

lolive 3y ago

LetsEncrypt is FANTASTIC !

eatbitseveryday 3y ago

I think you're conflating two things. Protecting against modification of data in-transit can be done without encryption. Signing the clear-text content allows the receiver to verify if the data is original. Encrypting hides the content from middle parties.

janosdebugs 3y ago
In the age of interest-based advertising is it really reasonable to suggest that we should let our network provider see every single website and subpage we visit?
- checkyoursudo 3y ago
  This is really my problem with the "don't encrypt anything static" argument. I don't encrypt for security (or at least not primarily; I am not under the illusion that encryption makes my data unassailable) but for privacy. There is a big difference between every jump between me and example.com seeing "example.com" or "example.com/so-you-think-you-might-be-heading-for-divorce.html" (just an example; I am happily married, in case my wife ever sees this).
lolinder 3y ago
Signing clear-text content requires only slightly less infrastructure than encrypting it, for a less useful result. I don't want every party in between me and the destination server to be able to see the contents of my HTTP requests, even for static pages. HTTPS is what makes the difference between an ISP being able to see that Alice is on WebMD and an ISP being able to see that Alice thinks she has a specific embarrassing illness.
- janosdebugs 3y ago
  Or even worse, Alice was just curious because of a conversation that happened and now her advertising profile will mark her as an insurance risk.

andrewmcwatters 3y ago

That's not what the article is suggesting.

janosdebugs 3y ago
> My medical opinion: if it hurts, maybe you should stop doing it. Which part of this is not suggesting we should stop using HTTPS?
- JohnFen 3y ago
  I interpreted that as meaning stop using LE, not stop using HTTPS. But in context, I see it can be reasonably interpreted either way.
  - janosdebugs 3y ago
    It doesn't matter which CA one is using as long as there is a CA that's freely available to anyone. The article makes very questionable suggestions such as this: > For decades, users of SSH have had a system (save the certificate permanently the first time you connect, and warn if it ever changes) that is optimal in a sense: it works at least as well as any other solution. It's trivial to implement, is completely free, involves no third parties, and lasts forever. To the surprise of absolutely no one, web browsers don't support it. I would interpret this as the author arguing against the entire CA system.

devmor 3y ago

The days of plain HTTP were amazing, from the point of view of a teenage hacker that hung out at the public library of a college town. At one point when Facebook started becoming popular, I had a script on my laptop that would grab session cookies from other people on the network and post things to the victims' facebook status like "I'm using unsecured wifi at the public library and I like to sniff butts"! Learning that stuff taught me a lot about network security, and left me with a wariness of trusting networks that I don't control that I still keep close to heart long into my career.

ip_addr 3y ago
The days of Firesheep