5 ms·

> We started off with SSL/TLS being used for payments systems and logins ... If it says the certificate for your bank is expired, you need to stop. If it says t

> We started off with SSL/TLS being used for payments systems and logins ... If it says the certificate for your bank is expired, you need to stop. If it says the certificate for the 10 year old public blog post that was linked by a 5 year old Reddit post as describing the solution to your problem, that should not matter Non-HTTPS pages can be tampered with to inject any content into them e.g. into a blog post page, you could inject a login form ("sign in via Google to unlock this post"), a donation payment form ("donate for more content like this!"), or malware installers ("your browser is out of date, click to update" banner). I think pushing to protect non-tech savvy users makes sense here. I see even a lot of developers not understanding risks like the above, so it's a losing battle thinking non-techy users can be educated about it and be cautious enough.

snickerdoodle12 1y ago
> Non-HTTPS pages can be tampered with to inject any content into them e.g. into a blog post page, you could inject a login form ("sign in via Google to unlock this post"), a donation payment form ("donate for more content like this!"), or malware installers. Who cares? The blog author could be malicious. The blog might have been sold 5 years ago and now hosts malicious content. Stop trying to nanny people, it's unbecoming.
- krior 1y ago
  But you can atleast acknowledge that there is a difference between trusting a blog you are actively seeking out and all the entities between you and said blog, right?
  - snickerdoodle12 1y ago
    Not really. The context is some random reddit post from close to a decade ago linking it. Might as well have typed a random URL in your browser.
- charcircuit 1y ago
  The people getting their money and accounts stolen care. The blog owner cares about the reputational hit. People who care about the success of the web care because it makes the web more risky than people using mobile apps.
  - snickerdoodle12 1y ago
    Yes and if you slit your wrists with a knife you will likely die. Do stupid things, bad things happen. Stop nannying people.
    - charcircuit 1y ago
      So visiting a website is doing a stupid thing? Your recommendation is essentially telling people to stop visiting websites or accept bad things will happen to them. This is not a healthy viewpoint for growing the web.
      - Dylan16807 1y ago
        The stupid behaviors listed above are putting your google password or payment info into a random blog, or running a program it gives you because it says you need to update. Doing that is stupid whether it's http or valid https or broken https.
        charcircuit 1y ago
        Okay, but if a user went to a http version of YouTube and put in your payment info to buy a movie, as opposed to remembering it should take him to an https Google page, I would find that a plausible situation that is hard to blame the user for. Attackers being able to hijack the reputation of sites is problematic.
        Dylan16807 1y ago
        > Attackers being able to hijack the reputation of sites is problematic. And the whole point of this thread is that some sites have 0 reputation to hijack.

snickerdoodle12 1y ago

> Non-HTTPS pages can be tampered with to inject any content into them e.g. into a blog post page, you could inject a login form ("sign in via Google to unlock this post"), a donation payment form ("donate for more content like this!"), or malware installers. Who cares? The blog author could be malicious. The blog might have been sold 5 years ago and now hosts malicious content. Stop trying to nanny people, it's unbecoming.

krior 1y ago
But you can atleast acknowledge that there is a difference between trusting a blog you are actively seeking out and all the entities between you and said blog, right?
- snickerdoodle12 1y ago
  Not really. The context is some random reddit post from close to a decade ago linking it. Might as well have typed a random URL in your browser.
charcircuit 1y ago
The people getting their money and accounts stolen care. The blog owner cares about the reputational hit. People who care about the success of the web care because it makes the web more risky than people using mobile apps.
- snickerdoodle12 1y ago
  Yes and if you slit your wrists with a knife you will likely die. Do stupid things, bad things happen. Stop nannying people.
  - charcircuit 1y ago
    So visiting a website is doing a stupid thing? Your recommendation is essentially telling people to stop visiting websites or accept bad things will happen to them. This is not a healthy viewpoint for growing the web.
    - Dylan16807 1y ago
      The stupid behaviors listed above are putting your google password or payment info into a random blog, or running a program it gives you because it says you need to update. Doing that is stupid whether it's http or valid https or broken https.
      - charcircuit 1y ago
        Okay, but if a user went to a http version of YouTube and put in your payment info to buy a movie, as opposed to remembering it should take him to an https Google page, I would find that a plausible situation that is hard to blame the user for. Attackers being able to hijack the reputation of sites is problematic.
        Dylan16807 1y ago
        > Attackers being able to hijack the reputation of sites is problematic. And the whole point of this thread is that some sites have 0 reputation to hijack.