4 ms·

Out of curiosity, why do you want unencrypted HTTP when HTTPS is available?

by josephg 2y ago

400thecat 2y ago
why do you want to save a file unencrypted on your filesystem, when encryption is available?
- soulofmischief 2y ago
  You generally shouldn't. But data at rest is different from data in transit in that you are vulnerable to a MITM with data in transit. Who cares if you're saving an encrypted file or not, if you can't trust that it's the same file that you intended to access.
- frizlab 2y ago
  Saving unencrypted data at rest is not possible anymore on macOS. Even though it may appear as unencrypted, it is always encrypted.
- archerx 2y ago
  Because I still want access to my files if there is a catastrophic system failure?
chacham15 2y ago
honestly, i run into the same issue. my use case is mostly for older wifi capture portals which just dont work against https since they obviously cant mitm the user. my other use case is for development work when I want to capture the traffic with wireshark without setting up https stripping via pinned certificate myself.
ryandrake 2y ago
With all respect: because I want to, and I expect my computer to do what I command it to do, not second-guess me. I understand the use cases for HTTPS vs. HTTP, and in some cases I deliberately want HTTP. It is not my browser's job to wag its finger at me and "correct" me. I'm really tired of using a computer and feeling like a passenger rather than the driver.
- josephg 2y ago
  Then use Firefox. Firefox has an option for this: https://superuser.com/questions/1721511/firefox-allow-http-urls-and-not-force-https https://superuser.com/questions/1721511/firefox-allow-http-u... https://support.mozilla.org/en-US/kb/https-only-prefs#w_enabledisable-https-only-mode https://support.mozilla.org/en-US/kb/https-only-prefs#w_enab... There’s plenty of reasons to be mad at big corporations. But for now at least, Firefox still supports your right to make bad life choices on the internet.
evanjrowley 2y ago
For signed content where confidentiality is not important, an unencrypted HTTP connection is totally fine. Some components of Public Key Infrastructure itself use unencrypted HTTP for this very reason. See Online Certificate Status Protocol (OCSP) - a method for distributing Certificate Revocation Lists. Many Linux distributions operate package repositories in this manner. It allows caching of packages through a variety of methods. Generally, CDNs can distribute signed HTTP content without requiring a customer to share a private key as would normally be required by HTTPS. So long as confidentiality is not a requirement. The IETF, Google, and Cloudflare have been developing standards for it. https://www.ietf.org/archive/id/draft-ietf-httpbis-message-signatures-04.html https://www.ietf.org/archive/id/draft-ietf-httpbis-message-s... https://wicg.github.io/webpackage/draft-yasskin-http-origin-signed-responses.html https://wicg.github.io/webpackage/draft-yasskin-http-origin-... https://developer.chrome.com/blog/signed-exchanges https://developer.chrome.com/blog/signed-exchanges https://news.ycombinator.com/item?id=29281449 https://news.ycombinator.com/item?id=29281449
- yencabulator 2y ago
  These examples are not in the browser context at all.
  - evanjrowley 2y ago
    The package repo one is. You should be able to browse it over HTTP, just as they also used to be browsable via Internet Explorer's FTP mode. Parent post didn't expliticly ask for browser context only.
    - josephg 2y ago
      Why? What benefit is there to browsing a package repo over plain http when https is available? Mitm attacks seem incredibly dangerous in a package repo. Signing only gets you so far - and they probably don’t protect you from downgrade attacks.
      - ryandrake 2y ago
jocoda 2y ago
I worked on a project where the site uses HTTP. Initially I did a double take as using requires a login, thinking that's just wrong. But after a bit of reflection I now think that in this specific case there's nothing bad about using http. Services are offered on a first come first serve basis to a large but closed group of valid users. Key is that there are a bunch of real world processes that follow the initial trigger with no practical way for any other party to benefit. The site is extremely simple but blazingly fast.
- josephg 2y ago
  Sorry, but why is http a benefit here? Http has lots of downsides - like the traffic can be snooped and edited. (It is edited by many ISPs for advertising. And in countries like Australia the ISPs are required by law to log all http requests.) And of course, you can’t use http2 without tls. What is the benefit to turning https off?

Out of curiosity, why do you want unencrypted HTTP when HTTPS is available?

400thecat 2y ago

why do you want to save a file unencrypted on your filesystem, when encryption is available?

soulofmischief 2y ago
You generally shouldn't. But data at rest is different from data in transit in that you are vulnerable to a MITM with data in transit. Who cares if you're saving an encrypted file or not, if you can't trust that it's the same file that you intended to access.
frizlab 2y ago
Saving unencrypted data at rest is not possible anymore on macOS. Even though it may appear as unencrypted, it is always encrypted.
archerx 2y ago
Because I still want access to my files if there is a catastrophic system failure?

chacham15 2y ago

honestly, i run into the same issue. my use case is mostly for older wifi capture portals which just dont work against https since they obviously cant mitm the user. my other use case is for development work when I want to capture the traffic with wireshark without setting up https stripping via pinned certificate myself.

ryandrake 2y ago

With all respect: because I want to, and I expect my computer to do what I command it to do, not second-guess me. I understand the use cases for HTTPS vs. HTTP, and in some cases I deliberately want HTTP. It is not my browser's job to wag its finger at me and "correct" me. I'm really tired of using a computer and feeling like a passenger rather than the driver.

josephg 2y ago
Then use Firefox. Firefox has an option for this: https://superuser.com/questions/1721511/firefox-allow-http-urls-and-not-force-https https://superuser.com/questions/1721511/firefox-allow-http-u... https://support.mozilla.org/en-US/kb/https-only-prefs#w_enabledisable-https-only-mode https://support.mozilla.org/en-US/kb/https-only-prefs#w_enab... There’s plenty of reasons to be mad at big corporations. But for now at least, Firefox still supports your right to make bad life choices on the internet.

evanjrowley 2y ago

For signed content where confidentiality is not important, an unencrypted HTTP connection is totally fine. Some components of Public Key Infrastructure itself use unencrypted HTTP for this very reason. See Online Certificate Status Protocol (OCSP) - a method for distributing Certificate Revocation Lists. Many Linux distributions operate package repositories in this manner. It allows caching of packages through a variety of methods. Generally, CDNs can distribute signed HTTP content without requiring a customer to share a private key as would normally be required by HTTPS. So long as confidentiality is not a requirement. The IETF, Google, and Cloudflare have been developing standards for it. https://www.ietf.org/archive/id/draft-ietf-httpbis-message-signatures-04.html https://www.ietf.org/archive/id/draft-ietf-httpbis-message-s... https://wicg.github.io/webpackage/draft-yasskin-http-origin-signed-responses.html https://wicg.github.io/webpackage/draft-yasskin-http-origin-... https://developer.chrome.com/blog/signed-exchanges https://developer.chrome.com/blog/signed-exchanges https://news.ycombinator.com/item?id=29281449 https://news.ycombinator.com/item?id=29281449

yencabulator 2y ago
These examples are not in the browser context at all.
- evanjrowley 2y ago
  The package repo one is. You should be able to browse it over HTTP, just as they also used to be browsable via Internet Explorer's FTP mode. Parent post didn't expliticly ask for browser context only.
  - josephg 2y ago
    Why? What benefit is there to browsing a package repo over plain http when https is available? Mitm attacks seem incredibly dangerous in a package repo. Signing only gets you so far - and they probably don’t protect you from downgrade attacks.
    - ryandrake 2y ago

jocoda 2y ago

I worked on a project where the site uses HTTP. Initially I did a double take as using requires a login, thinking that's just wrong. But after a bit of reflection I now think that in this specific case there's nothing bad about using http. Services are offered on a first come first serve basis to a large but closed group of valid users. Key is that there are a bunch of real world processes that follow the initial trigger with no practical way for any other party to benefit. The site is extremely simple but blazingly fast.

josephg 2y ago
Sorry, but why is http a benefit here? Http has lots of downsides - like the traffic can be snooped and edited. (It is edited by many ISPs for advertising. And in countries like Australia the ISPs are required by law to log all http requests.) And of course, you can’t use http2 without tls. What is the benefit to turning https off?