3 ms·
The threat model of plain http is about the user (and injected content) and not the server. Plain http is a threat to users. Has it really been so many years s
by foobiekr 2y ago
The threat model of plain http is about the user (and injected content) and not the server. Plain http is a threat to users.
Has it really been so many years since people used to do tcp injections and walk around coffee shops or whatever returning results faster than the internet server and injecting goatse?
You guys have forgotten who tls protects.
- superkuh 2y agoNope, you've just applied your application model of the web to the web as a whole. Most websites are not actually applications and the risk of "injected content" to people with javascript turned off is very, very low. The risk comes from the absolutely bonkers corporate/institutional use cases of automatically executing all random unverified programs sent to you. When you remove this crazy use case suddenly all the problems (and bonkers requirements) go away. Seeing a goatse is not the end of the world and actual MITM injection attacks like you describe are rather rare now. I miss when wifi use to be open and that issue mattered.
- foobiekr 2y agoThe average user does not have JavaScript turned off. Plain http sites are a risk to their users.