4 ms·
Why? Should it use the dict protocol, then?
by sam_lowry_ 1y ago
Why? Should it use the dict protocol, then?
- rootnod3 1y agoHow about HTTPS?
- mattmanser 1y agoBecause without HTTPS it's trivial to MITM that clipboard content if they're always sending it via http. People in your coffee shop on the same WiFi could read it. I get some people don't realize that's how TCP/IP works and the firesheep stuff all happened 15 years ago. But a bit worrying to see a frequent HN contributor challenging that. That's why we now push for Https everywhere.
- __MatrixMan__ 1y agoHttps everywhere is a good start, it keeps the other plebs at the coffee shop out of your business. But it's still open to anyone with enough power to coerce a CA, which is the more concerning sort of adversary anyhow. So yes, https everywhere, but let's not stop there.
- dannyw 1y agoYes, but we have widely deployed efforts like certificate transparency, and cert pinning. The first makes such attacks widely known events, browsers report by default, and it s provable. It’s very rare. The second allows apps to only trust specific certs or CAs, ignoring system root of trust. I just want to clarify HTTPS in practice is quite secure.
- __MatrixMan__ 1y agoI'll not let go of my distaste for roots of trust in any form, but you likely have a point. I'll have to learn more about this transparency thing.
- charcircuit 1y ago>People in your coffee shop on the same WiFi could read it. WEP has been deprecated for over 2 decades.
- ants_everywhere 1y agoyou may be surprised at the number of unsecured WiFi networks there are. I see them in 2025 in captive portals, public libraries, and when traveling abroad.
- kstrauser 1y agoThat has no effect on the owner of a malicious access point. HTTP over WPA2 is plaintext again the moment the AP decrypts it.
- deleted 1y ago[deleted]
- zamadatix 1y agoNot all guest Wi-Fi uses a PSK. In general, assuming all networks will already be encrypted along each hop to the server is a losing assumption for users.