5 ms·
I think you're conflating two things. Protecting against modification of data in-transit can be done without encryption. Signing the clear-text content allows
by eatbitseveryday 3y ago
I think you're conflating two things.
Protecting against modification of data in-transit can be done without encryption. Signing the clear-text content allows the receiver to verify if the data is original. Encrypting hides the content from middle parties.
- janosdebugs 3y agoIn the age of interest-based advertising is it really reasonable to suggest that we should let our network provider see every single website and subpage we visit?
- checkyoursudo 3y agoThis is really my problem with the "don't encrypt anything static" argument. I don't encrypt for security (or at least not primarily; I am not under the illusion that encryption makes my data unassailable) but for privacy. There is a big difference between every jump between me and example.com seeing "example.com" or "example.com/so-you-think-you-might-be-heading-for-divorce.html" (just an example; I am happily married, in case my wife ever sees this).
- lolinder 3y agoSigning clear-text content requires only slightly less infrastructure than encrypting it, for a less useful result. I don't want every party in between me and the destination server to be able to see the contents of my HTTP requests, even for static pages. HTTPS is what makes the difference between an ISP being able to see that Alice is on WebMD and an ISP being able to see that Alice thinks she has a specific embarrassing illness.
- janosdebugs 3y agoOr even worse, Alice was just curious because of a conversation that happened and now her advertising profile will mark her as an insurance risk.