4 ms·
Doesn't that mean that technically, any node in the network between you and your reader can mutate the contents of the blog in-transit without anyone being the
by shadowgovt 1y ago
Doesn't that mean that technically, any node in the network between you and your reader can mutate the contents of the blog in-transit without anyone being the wiser (up to and including arbitrary JavaScript inline injection)?
Probably a low-threat security risk for a blog.
- bawolff 1y agoFor a blog, i think the bigger risk is pervasive surveilence - gov reads all the connections and puts you on a list if the thing you are reading has the wrong keyword in it.
- bsilvereagle 1y agoYes, hotels were injecting ads on their free WiFi - https://news.ycombinator.com/item?id=3804608 https://news.ycombinator.com/item?id=3804608
- riffic 1y agoISPs have been known to do the same thing.
- Ferret7446 1y agoDevil's advocate, but maybe ISPs should all inject ads to make a point. They make money, and anyone using HTTP gets taught a free lesson on what MITM means
- sam_lowry_ 1y agoBefore turning on the dude who thrives to keep the internet free, fix your corporate laptop that does MITM even for HTTPS connections.
- 01HNNWZ0MV43FF 1y agoI own a personal laptop?
- DaSHacka 1y ago"Free" for fraudsters to get their pickings, maybe.
- sam_lowry_ 1y agoI'd be happy if EU outlawed this instead of outlawing encryption. But indeed, the ability to publish on my own outweights the risk of someone modding my content. Most of us here read their news from work laptops, where the employer and their MiTM supplier are a much bigger threat even for HTTPS websites.
- shadowgovt 1y agoThis puts the question into my brain, which I have never thought to pursue, of whether you could offer a self-signed cert that the user has to install for HTTPS. Their client will complain loudly until and unless they install it, but then for those who care you could offer the best of both worlds. Almost certainly more trouble than it's worth. G'ah, and me without any free time to pursue a weekend hobby project!
- dns_snek 1y ago> for those who care you could offer the best of both worlds. You're not really offering that because the first connection could've be intercepted.
- shadowgovt 1y agoToo true. The old model is that you have to sneaker-net that first step. To get someone's public key, you'd literally meet them in person and they'd hand you a copy. We don't do that anymore. I can imagine alternate approaches (service that stores personal keys on an HTTPS server signed via a public cert, keys in peer-to-peer filesharing with the checksum provided side-channel), but that gets increasingly more elaborate for diminishing return.