4 ms·

Why should my blog of static pages need to be served over HTTPS to avoid having Firefox slap a scary red icon next to it?

by omni 12y ago

briansmith 12y ago
http://arstechnica.com/security/2014/07/the-nsa-thinks-linux-journal-is-an-extremist-forum/ http://arstechnica.com/security/2014/07/the-nsa-thinks-linux...
- omni 12y ago
  HTTPS does nothing for anonymity, though, right? It's only for protecting the actual content being transmitted? If so, there is no sensitive content being exchanged between a user and a static page that doesn't support login or anything.
  - scrollaway 12y ago
    HTTPS protects metadata as well (to a large extent).
  - briansmith 12y ago
    Aggregating the content of the web pages you have read can be used to deduce your identity, and/or the content of the web pages can be used to select you for targeting, like in the article I linked to above. For example, let's say you wrote a blog post about fixing a configuration issue for touchpad issues on a ThinkPad X1 Carbon on Ubuntu 12.04. Imagine that a passive MitM saved the IP address of everybody who read that blog post in a database. Then, if an "interesting" person is known to be a ThinkPad X1 Carbon owner that uses Ubuntu 12.04. They can use that list of IP addresses of readers of that specific blog post to help narrow the search for the possible locations (via geo-IP) of that user. Right now it is pretty easy to distinguish which webpage on your blog the reader is reading through traffic analysis, even when HTTPS is being used. But, people are working on things that make that traffic analysis more difficult.
scrollaway 12y ago
Why shouldn't it is the real question. There's a parallel universe where ssh is plaintext, and only "sensitive commands", such as "sudo", are encrypted. In that universe though, plaintext HTTP doesn't exist and they're making fun of us.
- mynameisvlad 12y ago
  Because no sensitive content is being transferred. Why put the extra hassle of getting and installing a non-self-signed certificate for a blog where the user doesn't even submit data? There's no reason for that connection to be secure.
  - scrollaway 12y ago
    > Because no sensitive content is being transferred. You're answering "why" instead of answering "why not" again. "Why should you lock your door if you don't have anything expensive?" Plaintext HTTP should not exist, then we wouldn't be having this discussion. I wouldn't have to come up with elaborate scenarios where having HTTPS from the get go would have saved lives, and you wouldn't have to come up with crazy "but that'll never happen" retort to them. Unfortunately, plaintext HTTP exists, so here we are, with me telling you that the pro-gay rights piece you wrote on your static blog contains keywords that make it be viewed as extremism/terrorism by Russia's automated monitoring systems and anyone reading it gets immediately added to a watchlist. Unfortunately, a few of your readers are from russia and six months later those readers join a political protest against the killing of kittens or something. Their government notices that and makes sure to "take action". And to think HTTPS could have avoided that.
    - Yver 12y ago
      > "Why should you lock your door if you don't have anything expensive?" Locks come standard on every door, they don't expire after a given time and every child knows how to use them. See how your comparison to acquiring, setting up and maintainning an SSL certificate is nonsensical? > And to think HTTPS could have avoided that. If the NSA tags people who look for info on TOR as extremists, an hypothetical state might tag people who use HTTPS. And to think that HTTP could have avoided that! I mean, if every argument is an hypothetical, anything is possible.
AlyssaRowan 12y ago
Why should an attacker get to inject malicious content into your blog to infect your readers? After a transition period, all plaintext protocols should be completely deprecated except for extremely special use, much like telnet was.

Why should my blog of static pages need to be served over HTTPS to avoid having Firefox slap a scary red icon next to it?

by omni 12y ago

Why should my blog of static pages need to be served over HTTPS to avoid having Firefox slap a scary red icon next to it?

briansmith 12y ago

http://arstechnica.com/security/2014/07/the-nsa-thinks-linux-journal-is-an-extremist-forum/ http://arstechnica.com/security/2014/07/the-nsa-thinks-linux...

omni 12y ago
HTTPS does nothing for anonymity, though, right? It's only for protecting the actual content being transmitted? If so, there is no sensitive content being exchanged between a user and a static page that doesn't support login or anything.
- scrollaway 12y ago
  HTTPS protects metadata as well (to a large extent).
- briansmith 12y ago
  Aggregating the content of the web pages you have read can be used to deduce your identity, and/or the content of the web pages can be used to select you for targeting, like in the article I linked to above. For example, let's say you wrote a blog post about fixing a configuration issue for touchpad issues on a ThinkPad X1 Carbon on Ubuntu 12.04. Imagine that a passive MitM saved the IP address of everybody who read that blog post in a database. Then, if an "interesting" person is known to be a ThinkPad X1 Carbon owner that uses Ubuntu 12.04. They can use that list of IP addresses of readers of that specific blog post to help narrow the search for the possible locations (via geo-IP) of that user. Right now it is pretty easy to distinguish which webpage on your blog the reader is reading through traffic analysis, even when HTTPS is being used. But, people are working on things that make that traffic analysis more difficult.

scrollaway 12y ago

Why shouldn't it is the real question. There's a parallel universe where ssh is plaintext, and only "sensitive commands", such as "sudo", are encrypted. In that universe though, plaintext HTTP doesn't exist and they're making fun of us.

mynameisvlad 12y ago
Because no sensitive content is being transferred. Why put the extra hassle of getting and installing a non-self-signed certificate for a blog where the user doesn't even submit data? There's no reason for that connection to be secure.
- scrollaway 12y ago
  > Because no sensitive content is being transferred. You're answering "why" instead of answering "why not" again. "Why should you lock your door if you don't have anything expensive?" Plaintext HTTP should not exist, then we wouldn't be having this discussion. I wouldn't have to come up with elaborate scenarios where having HTTPS from the get go would have saved lives, and you wouldn't have to come up with crazy "but that'll never happen" retort to them. Unfortunately, plaintext HTTP exists, so here we are, with me telling you that the pro-gay rights piece you wrote on your static blog contains keywords that make it be viewed as extremism/terrorism by Russia's automated monitoring systems and anyone reading it gets immediately added to a watchlist. Unfortunately, a few of your readers are from russia and six months later those readers join a political protest against the killing of kittens or something. Their government notices that and makes sure to "take action". And to think HTTPS could have avoided that.
  - Yver 12y ago
    > "Why should you lock your door if you don't have anything expensive?" Locks come standard on every door, they don't expire after a given time and every child knows how to use them. See how your comparison to acquiring, setting up and maintainning an SSL certificate is nonsensical? > And to think HTTPS could have avoided that. If the NSA tags people who look for info on TOR as extremists, an hypothetical state might tag people who use HTTPS. And to think that HTTP could have avoided that! I mean, if every argument is an hypothetical, anything is possible.

AlyssaRowan 12y ago

Why should an attacker get to inject malicious content into your blog to infect your readers? After a transition period, all plaintext protocols should be completely deprecated except for extremely special use, much like telnet was.