4 ms·

I don't think anybody should go as all-in as the OP in the article but he might have some good points. Why does everything have to be https? Like, if I am writi

by hk1337 1y ago

I don't think anybody should go as all-in as the OP in the article but he might have some good points. Why does everything have to be https? Like, if I am writing a basic blog, with no forms, no CC payments, doesn't capture anything sensitive, why do I need an SSL certificate to appear as a valid site?

perching_aix 1y ago
Because I want to read your words, not whatever other person's or machine's standing between your and my machine. It's one of the key points the author takes an issue with. That PKI is not MITM resistant enough, in the ways they dream of. That they need to monitor the CT logs, and that not being a whole lot.
- hk1337 1y ago
  That's a niche problem to have though. Most random bloggers are not going to be targets of MITM that rewrites their posts. If that becomes a problem, then sure, add HTTPS.
  - perching_aix 1y ago
    You can read about the history of the non-nicheness of this problem in other comments. It also doesn't need targeting.
jeroenhd 1y ago
Because your website will sell me Viagra and tell me to buy cryptocurrency when I visit it on some public wifis. Your words are also obscured by ISPs telling me that my router needs replacing and that I've nearly used up my data cap. You don't need TLS for your blog, though. Browsers will still connect to port 80 if you don't enable HTTPS.
the_snooze 1y ago
It's about integrity, not confidentiality. Without HTTPS, anyone between you and the server can mess with the content you're receiving. It could be injecting ads, or make the website upside-down [1], or replace downloads with malicious links. [1] https://pete.ex-parrot.com/upside-down-ternet.html https://pete.ex-parrot.com/upside-down-ternet.html
lesostep 1y ago
Back when http was more popular my mobile provider injected popups with ads on every http page like nobodies business. And I couldn't switch to another, they all did that. This isn't about theoretical MITM attack, it used to be widespread. And there isn't any reason why it wouldn't spread again if http got more popular

by hk1337 1y ago

perching_aix 1y ago

Because I want to read your words, not whatever other person's or machine's standing between your and my machine. It's one of the key points the author takes an issue with. That PKI is not MITM resistant enough, in the ways they dream of. That they need to monitor the CT logs, and that not being a whole lot.

hk1337 1y ago
That's a niche problem to have though. Most random bloggers are not going to be targets of MITM that rewrites their posts. If that becomes a problem, then sure, add HTTPS.
- perching_aix 1y ago
  You can read about the history of the non-nicheness of this problem in other comments. It also doesn't need targeting.

jeroenhd 1y ago

Because your website will sell me Viagra and tell me to buy cryptocurrency when I visit it on some public wifis. Your words are also obscured by ISPs telling me that my router needs replacing and that I've nearly used up my data cap. You don't need TLS for your blog, though. Browsers will still connect to port 80 if you don't enable HTTPS.

the_snooze 1y ago

It's about integrity, not confidentiality. Without HTTPS, anyone between you and the server can mess with the content you're receiving. It could be injecting ads, or make the website upside-down [1], or replace downloads with malicious links. [1] https://pete.ex-parrot.com/upside-down-ternet.html https://pete.ex-parrot.com/upside-down-ternet.html

lesostep 1y ago

Back when http was more popular my mobile provider injected popups with ads on every http page like nobodies business. And I couldn't switch to another, they all did that. This isn't about theoretical MITM attack, it used to be widespread. And there isn't any reason why it wouldn't spread again if http got more popular