5 ms·

> There are plenty of websites that were just static pages used for conveying information. If you care about the integrity of the conveyed information you need

by matrss 2y ago

> There are plenty of websites that were just static pages used for conveying information. If you care about the integrity of the conveyed information you need TLS. If you don't, you wouldn't have published a website in the first place. A while back I've seen a wordpress site for a podcast without https where people also argued it doesn't need it. They had banking information for donations on that site. Sometimes I wish every party involved in transporting packets on the internet would just mangle all unencrypted http that they see, if only to make a point...

dijit 2y ago
[flagged]
account42 2y ago
What ensures the integrity of conveyed information for physical mail? For flyers? For telephone conversations? The cryptography community would have you believe that the only solution to getting scammed is encryption. It isn't.
- matrss 2y ago
  > What ensures the integrity of conveyed information for physical mail? For flyers? For telephone conversations? Nothing, really. But for physical mail the attacks against it don't scale nearly as well: you would need to insert yourself physically into the transportation chain and do physical work to mess with the content. Messing with mail is also taken much more seriously as an offense in many places, while laws are not as strict for network traffic generally. For telephone conversations, at least until somewhat recently, the fact that synthesizing convincing speech in real time was not really feasible (especially not if you tried to imitate someones speech) ensured some integrity of the conversation. That has changed, though.
- ozim 2y ago
  My post I am typing here can happily go through Russia/China/India and you cannot do anything about it - and bad actors can actually make your traffic to go through them as per BGP hijacking that was happening multiple times. NSA was installing physical devices at network providers that was scouring through all information - they did not have to have Agent Smith opening envelopes or even looking at them. Keep in mind criminals could do the same as well just pay off some employees at provider and also not all network providers are in countries where law enforcement works - and as mentioned your data can go through any of such network providers. If I send physical mail I can be sure it is not going through Bangkok unless I specifically send it with destination that requires it to go there.
eesmith 2y ago
There is a specific class of websites that will always support non-TLS connections, like http://home.mcom.com/ http://home.mcom.com/ and http://textfiles.com/ http://textfiles.com/ . Like, "telnet textfiles.com 80" then "GET / HTTP/1.0", <enter>, "Location: textfile.com" <enter><enter> and you have the page. What would be the point of making these unencrypted sites disappear?
- matrss 2y ago
  textfiles.com says: "TEXTFILES.COM has been online for nearly 25 years with no ads or clickthroughs." I'd argue that that is a most likely objectively false statement and that the domain owner is in no position to authoritatively answer the question if it has ever served ads in that time. As it is served without TLS any party involved in the transportation of the data can mess with its content and e.g. insert ads. There are a number of reports of ISPs having done exactly that in the past, and some might still do it today. Therefore it is very likely that textfiles.com as shown in someones browser has indeed had ads at some point in time, even if the one controlling the domain didn't insert them. Textfiles also contains donation links for PayPal and Venmo. That is an attractive target to replace with something else. And that is precisely the point: without TLS you do not have any authority over what anyone sees when visiting your website. If you don't care about that then fine, my comment about mangling all http traffic was a bit of a hyperbole. But don't be surprised when it happens anyway and donations meant for you go to someone else instead.
  - eesmith 2y ago
    There is a big difference between "served ads" and "ads inserted downstream." If you browse through your smart TV, and the smart TV overlays an ad over the browser window, or to the side, is that the same as saying the original server is serving those ads? I hope you agree it is not. If you use a web browser from a phone vendor who has a special Chromium build which inserts ads client-side in the browser, do you say that the server is serving those ads? Do you know that absolutely no browser vendors, including for low-cost phones, do this? If your ISP requires you configure your browser to use their proxy service, and that proxy service can insert ads, do you say that the server is serving those ads? Are you absolutely sure no ISPs have this requirement? If you use a service where you can email it a URL and it emails you the PDF of the web site, with some advertising at the bottom of each page, do you say the original server is really the one serving those ads? If you read my web site though archive.org, and archive.org has its "please donate to us" ad, do you really say that my site is serving those ads? Is there any web site which you can guarantee it's impossible for any possible user, no matter the hardware or connection, to see ads which did not come from the original server as long as the server has TLS? I find that impossible to believe. I therefore conclude that your interpretation is meaningless. > "as shown in someones browser" Which is different than being served by the server, as I believe I have sufficiently demonstrated. > But don't be surprised when it happens anyway Jason Scott, who runs that site, will not be surprised.
ndriscoll 2y ago
I'm pretty sure tons of people have made web pages or sites without caring about the integrity of the conveyed information. Not every website is something important like banking. It doesn't matter if a nefarious actor tweaks the information on a Shining Force II shrine (and even then, only for people who they're able to MITM). In practice, many pages are also intentionally compromised by their authors (e.g. including malware scripts from Google), and devices are similarly compromised, so end-to-end "integrity" of the page isn't something the device owner even necessarily wants (c.f. privoxy).

by matrss 2y ago

dijit 2y ago

[flagged]

account42 2y ago

What ensures the integrity of conveyed information for physical mail? For flyers? For telephone conversations? The cryptography community would have you believe that the only solution to getting scammed is encryption. It isn't.

matrss 2y ago
> What ensures the integrity of conveyed information for physical mail? For flyers? For telephone conversations? Nothing, really. But for physical mail the attacks against it don't scale nearly as well: you would need to insert yourself physically into the transportation chain and do physical work to mess with the content. Messing with mail is also taken much more seriously as an offense in many places, while laws are not as strict for network traffic generally. For telephone conversations, at least until somewhat recently, the fact that synthesizing convincing speech in real time was not really feasible (especially not if you tried to imitate someones speech) ensured some integrity of the conversation. That has changed, though.
ozim 2y ago
My post I am typing here can happily go through Russia/China/India and you cannot do anything about it - and bad actors can actually make your traffic to go through them as per BGP hijacking that was happening multiple times. NSA was installing physical devices at network providers that was scouring through all information - they did not have to have Agent Smith opening envelopes or even looking at them. Keep in mind criminals could do the same as well just pay off some employees at provider and also not all network providers are in countries where law enforcement works - and as mentioned your data can go through any of such network providers. If I send physical mail I can be sure it is not going through Bangkok unless I specifically send it with destination that requires it to go there.

eesmith 2y ago

There is a specific class of websites that will always support non-TLS connections, like http://home.mcom.com/ http://home.mcom.com/ and http://textfiles.com/ http://textfiles.com/ . Like, "telnet textfiles.com 80" then "GET / HTTP/1.0", <enter>, "Location: textfile.com" <enter><enter> and you have the page. What would be the point of making these unencrypted sites disappear?

matrss 2y ago
textfiles.com says: "TEXTFILES.COM has been online for nearly 25 years with no ads or clickthroughs." I'd argue that that is a most likely objectively false statement and that the domain owner is in no position to authoritatively answer the question if it has ever served ads in that time. As it is served without TLS any party involved in the transportation of the data can mess with its content and e.g. insert ads. There are a number of reports of ISPs having done exactly that in the past, and some might still do it today. Therefore it is very likely that textfiles.com as shown in someones browser has indeed had ads at some point in time, even if the one controlling the domain didn't insert them. Textfiles also contains donation links for PayPal and Venmo. That is an attractive target to replace with something else. And that is precisely the point: without TLS you do not have any authority over what anyone sees when visiting your website. If you don't care about that then fine, my comment about mangling all http traffic was a bit of a hyperbole. But don't be surprised when it happens anyway and donations meant for you go to someone else instead.
- eesmith 2y ago
  There is a big difference between "served ads" and "ads inserted downstream." If you browse through your smart TV, and the smart TV overlays an ad over the browser window, or to the side, is that the same as saying the original server is serving those ads? I hope you agree it is not. If you use a web browser from a phone vendor who has a special Chromium build which inserts ads client-side in the browser, do you say that the server is serving those ads? Do you know that absolutely no browser vendors, including for low-cost phones, do this? If your ISP requires you configure your browser to use their proxy service, and that proxy service can insert ads, do you say that the server is serving those ads? Are you absolutely sure no ISPs have this requirement? If you use a service where you can email it a URL and it emails you the PDF of the web site, with some advertising at the bottom of each page, do you say the original server is really the one serving those ads? If you read my web site though archive.org, and archive.org has its "please donate to us" ad, do you really say that my site is serving those ads? Is there any web site which you can guarantee it's impossible for any possible user, no matter the hardware or connection, to see ads which did not come from the original server as long as the server has TLS? I find that impossible to believe. I therefore conclude that your interpretation is meaningless. > "as shown in someones browser" Which is different than being served by the server, as I believe I have sufficiently demonstrated. > But don't be surprised when it happens anyway Jason Scott, who runs that site, will not be surprised.

ndriscoll 2y ago

I'm pretty sure tons of people have made web pages or sites without caring about the integrity of the conveyed information. Not every website is something important like banking. It doesn't matter if a nefarious actor tweaks the information on a Shining Force II shrine (and even then, only for people who they're able to MITM). In practice, many pages are also intentionally compromised by their authors (e.g. including malware scripts from Google), and devices are similarly compromised, so end-to-end "integrity" of the page isn't something the device owner even necessarily wants (c.f. privoxy).