4 ms·

It sounds diabolical if you approach it from the direction of "what have they done to my browser sessions!?" but I think if you approach it from their developme

It sounds diabolical if you approach it from the direction of "what have they done to my browser sessions!?" but I think if you approach it from their development path it seems much less so. From their perspective, the phone was too weak to run a full browser so they almost approached it like an XWindows session. All the work happens on their servers and the phone just collects keystrokes and taps and displays pictures. Of course they can see all of your encrypted sessions. The real browser is running on their hardware at their office. "We're the good guys, we'll keep our users' sessions private!". What makes it muddy is that the display mechanism is a cut down browser-like thingy instead of a framebuffer. In their minds, who cares what happens to https on that section of the link; all they're doing is showing pictures... but from the users perspective? WTF did you do to my https session?! Its decidedly suboptimal, but not quite so outrageous as it first sounds.

bad_user 14y ago
The whole freaking point of HTTPS is to prevent man-in-the-middle scenarios. If somebody does listen to your connection without you noticing it, then it's an issue of trust. Maybe Nokia is not diabolical, although as any other commercial for-profit entity they care much more about their bottom-line. It isn't any different than trusting Google with your email, but for example, suppose you connect to Gmail on the web from such a Nokia device, are you prepared to have your communications available to not just 1, but 2 commercial entities? The far bigger point however is that their servers represent a point of failure. I may trust that they won't do anything with my data, but can I trust that they are competent enough to secure their own servers? What about disgruntled employees with enough privileges? Considering how many people they fired and how bleak their future is, I'm sure they have at least some disgruntled employees. Again, you can say this about any service. You don't know how secure a bank's servers are, right? But on the other hand, why in the world does Nokia need to do this? A simple message informing users that SSL connections are slower should have been enough. Or at least a warning of some sorts that the connection is not entirely secure and in case you connect to your bank account you should do it from another device. Instead, you're left with the impression that the connection is secure, when in fact there's a man in the middle who's competence is doubtful, a fact proven by the deployment of this feature alone.
- noonespecial 14y ago
  Sure its terrible from the users perspective, but from Nokia's, by the time they decided it was a good idea to monkey with HTTPS, they already had the equivalent of a screen-cap trojan complete with full-on keylogger already installed. Can you blame them for the "meh" on HTTPS? If you don't have the juice in your browser-ette to run standard web, SSL isn't going to just be "slower", its not going to work at all either. But there's one thing we're in perfect agreement on. Nokia owed the users a truckload of transparency on this one. We should not have learned about it through some security researchers blog.

bad_user 14y ago

The whole freaking point of HTTPS is to prevent man-in-the-middle scenarios. If somebody does listen to your connection without you noticing it, then it's an issue of trust. Maybe Nokia is not diabolical, although as any other commercial for-profit entity they care much more about their bottom-line. It isn't any different than trusting Google with your email, but for example, suppose you connect to Gmail on the web from such a Nokia device, are you prepared to have your communications available to not just 1, but 2 commercial entities? The far bigger point however is that their servers represent a point of failure. I may trust that they won't do anything with my data, but can I trust that they are competent enough to secure their own servers? What about disgruntled employees with enough privileges? Considering how many people they fired and how bleak their future is, I'm sure they have at least some disgruntled employees. Again, you can say this about any service. You don't know how secure a bank's servers are, right? But on the other hand, why in the world does Nokia need to do this? A simple message informing users that SSL connections are slower should have been enough. Or at least a warning of some sorts that the connection is not entirely secure and in case you connect to your bank account you should do it from another device. Instead, you're left with the impression that the connection is secure, when in fact there's a man in the middle who's competence is doubtful, a fact proven by the deployment of this feature alone.

noonespecial 14y ago
Sure its terrible from the users perspective, but from Nokia's, by the time they decided it was a good idea to monkey with HTTPS, they already had the equivalent of a screen-cap trojan complete with full-on keylogger already installed. Can you blame them for the "meh" on HTTPS? If you don't have the juice in your browser-ette to run standard web, SSL isn't going to just be "slower", its not going to work at all either. But there's one thing we're in perfect agreement on. Nokia owed the users a truckload of transparency on this one. We should not have learned about it through some security researchers blog.