4 ms·

The problem is that HTTPS has become something of a cult in tech circles. Not every web site needs HTTPS. It matters not at all if some government sees me che

The problem is that HTTPS has become something of a cult in tech circles. Not every web site needs HTTPS. It matters not at all if some government sees me checking the weather, or reading about the best seeds to plant this time of year. And 99 44/100% of the MITM hype is pure theoretical hysteria. There is a very long distance between "could" and "will" and "can" and "did." I know a lot of people enjoy their paranoia fantasies. But real life isn't a Tom Cruise movie.

dale_glass 3y ago
> Not every web site needs HTTPS. Every site does. HTTPS should be the default, that increases security even if you're just looking at cat pictures in a given context. > It matters not at all if some government sees me checking the weather, or reading about the best seeds to plant this time of year. Absolutely does. Much can be deduced from your activity, like whether you're home, what your interests are, who you talk to, what skills you have. If somebody gets poisoned, then your interest in botany might suddenly make you of interest. For the most part nobody really wants to read your boring emails. But that you regularly talk to some controversial person, or spend a lot of time in their proximity, that's juicy information that may well paint a target on your back in the wrong circumstances. > And 99 44/100% of the MITM hype is pure theoretical hysteria. There is a very long distance between "could" and "will" and "can" and "did." Good news: it absolutely happens. MITM has been used for injecting ads in content, which of course can be used to nefarious effect. From just unethical, like replacing a site's original ads with your own and robbing them of the income, to actually malicious payloads.
giantrobot 3y ago
Holy shit man, ISPs are notorious for injecting ads and other garbage into web pages. Back when I had Comcast (Xfinity) they'd inject giant pop-up windows in web pages served over HTTP if I was approaching the asinine bandwidth limits. I also noticed an uptick in tracking ads on pages served over HTTP. Your ISP and mobile carriers are not trustworthy neutral carriers of data. Encrypted transports are the only way for end users to avoid their snooping and injection.
- reaperducer 3y ago
  Have fun injecting pop-ups and JavaScript crap into my Lynx sessions. Which is where nearly all of my HTTP browsing happens.
  - anonym29 3y ago
    Fine and well until someone injects code to exploit some 0day in lynx. Correct me if I'm wrong, but lynx doesn't even have sandboxing the way Chrome & FF do, right? Sure, it's a much smaller attack surface than those presented by traditional browsers, but if I had to hazard a guess, I'd assume it's been far less targeted, and considerably less hardened over the years. Note: this is NOT an endorsement of Chrome, FF, Webkit, Blink, Gecko, nor is it a suggestion to NOT use Lynx - just a reminder that there are no silver bullets in security.
  - giantrobot 3y ago
    So you use lynx so therefore MITM injection isn't a problem? I'm having trouble even imagining this is a good faith response because it is so painfully obtuse.

dale_glass 3y ago

> Not every web site needs HTTPS. Every site does. HTTPS should be the default, that increases security even if you're just looking at cat pictures in a given context. > It matters not at all if some government sees me checking the weather, or reading about the best seeds to plant this time of year. Absolutely does. Much can be deduced from your activity, like whether you're home, what your interests are, who you talk to, what skills you have. If somebody gets poisoned, then your interest in botany might suddenly make you of interest. For the most part nobody really wants to read your boring emails. But that you regularly talk to some controversial person, or spend a lot of time in their proximity, that's juicy information that may well paint a target on your back in the wrong circumstances. > And 99 44/100% of the MITM hype is pure theoretical hysteria. There is a very long distance between "could" and "will" and "can" and "did." Good news: it absolutely happens. MITM has been used for injecting ads in content, which of course can be used to nefarious effect. From just unethical, like replacing a site's original ads with your own and robbing them of the income, to actually malicious payloads.

giantrobot 3y ago

Holy shit man, ISPs are notorious for injecting ads and other garbage into web pages. Back when I had Comcast (Xfinity) they'd inject giant pop-up windows in web pages served over HTTP if I was approaching the asinine bandwidth limits. I also noticed an uptick in tracking ads on pages served over HTTP. Your ISP and mobile carriers are not trustworthy neutral carriers of data. Encrypted transports are the only way for end users to avoid their snooping and injection.

reaperducer 3y ago
Have fun injecting pop-ups and JavaScript crap into my Lynx sessions. Which is where nearly all of my HTTP browsing happens.
- anonym29 3y ago
  Fine and well until someone injects code to exploit some 0day in lynx. Correct me if I'm wrong, but lynx doesn't even have sandboxing the way Chrome & FF do, right? Sure, it's a much smaller attack surface than those presented by traditional browsers, but if I had to hazard a guess, I'd assume it's been far less targeted, and considerably less hardened over the years. Note: this is NOT an endorsement of Chrome, FF, Webkit, Blink, Gecko, nor is it a suggestion to NOT use Lynx - just a reminder that there are no silver bullets in security.
- giantrobot 3y ago
  So you use lynx so therefore MITM injection isn't a problem? I'm having trouble even imagining this is a good faith response because it is so painfully obtuse.