3 ms·
If that's your threat model then CA TLS is going to make things even worse for you because now the nation state pressure can be centralized and directed through
by superkuh 2y ago
If that's your threat model then CA TLS is going to make things even worse for you because now the nation state pressure can be centralized and directed through the CA.
There are trade-offs but HTTP has it's place. HTTP is far easier to set up, more robust, far more decentralized, supports far more other software, and has a longer lifetime. For humans who aren't dealing with nation state threat models those attributes make it very attractive and useful.
We should not cargo cult the requirements for a multi-national business that does monetary transactions and sends private information with a website run by a human person for recreation and other humans. There is more to the web than commerce and we should design for human persons as well as corporate persons.
- ozim 2y agoWere you familiar with Snowden revelations? How NSA was just putting gear in ISPs or nodes where are internet gateways to pass all traffic through their automated tooling? It was not monetary or business it is not “threat model” thing. Having all traffic encrypted is a must for basic human freedom.
- superkuh 2y agoIt is a human freedom thing. Having to get continued permission to host a visit-able website from a CA is very un-free. That's why HTTP+HTTPS is so good. The best of both worlds with the downsides of neither. Passive massive surveillance is by definition not doing active MITM targeting.
- ric2b 2y agoISP's have been known to inject ads into HTTP pages, and ads are the least malicious thing that could be done by an ISP or wifi hotspot. HTTP MITM is way too cheap and accessible to pretend you're not vulnerable to it constantly or that you need to be a target, you don't.