4 ms·

Alternative? Non-https is really harmful to users who browse via open wifi.

by diafygi 12y ago

wyager 12y ago
>Alternative? There exist several semi-viable alternatives at the moment. The most promising is Namecoin, which essentially allows for cryptographically authenticated public key/value storage, and so can function as both a DNS system and a system for announcing SSL pubkeys (without any trusted parties).
- pg_is_a_butt 12y ago
  trusting namecoin implementation doesn't count?
stephenr 12y ago
can be really harmful, in some applications I don't need to know that my connection to lol cats is secure and uninterrupted.
- harshreality 12y ago
  Let's assume a simple video site and html5 video. Do you want to bet there are no vulnerabilities in your browser's mp4/vp8 decoder? If there are, anyone can MITM your non-SSL connection and compromise the video decoding process, limited only by their cleverness and by whatever sandboxing your browser employs.
  - stephenr 12y ago
    Why does it have to be video? Some of the simplest sites around are plain text or text and images. Why do I need SSL or TLS to view either of these? I am very aware that anything authenticated should be carried over an encrypted connection - I'm not arguing against that. I'm saying there are use-cases that do not require it.
    - AlyssaRowan 12y ago
      Because otherwise nation-state adversaries can see everything you read. IETF position on this is pretty clear after the technical plenary last year.
      - stephenr 12y ago
        Again, why does it matter if you or Barack Obama or Kimg Jung Un knows that I like looking at Captain Picard meme pictures? How can you tell me that REQUIRES an encrypted connection? You know what might actually make some fucking sense. Enforce SSL/TLS where it is needed - disable HTTP Auth, Cookies, Location Services, Local Storage, etc over plain HTTP connections.
- rakoo 12y ago
  Do you want your location along with your credentials to your lol cats forum in the wild ? Depending on what site you're going to, you can be screwed pretty easily.
  - stephenr 12y ago
    I didn't mention credentials. Plenty of web use is anonymous, and has 0 need for SSL/TLS
    - AlyssaRowan 12y ago
      Counterexample: If you want it to be anonymous, you need TLS (and Tor!).
      - stephenr 12y ago
        Well I'm glad you're able to miss the fucking point with such efficiency
    - rakoo 12y ago
      You don't need credentials to be identified, your browser can be identified quite accurately (see https://panopticlick.eff.org/ https://panopticlick.eff.org/).

Alternative? Non-https is really harmful to users who browse via open wifi.

by diafygi 12y ago

Alternative? Non-https is really harmful to users who browse via open wifi.

>Alternative? There exist several semi-viable alternatives at the moment. The most promising is Namecoin, which essentially allows for cryptographically authenticated public key/value storage, and so can function as both a DNS system and a system for announcing SSL pubkeys (without any trusted parties).

pg_is_a_butt 12y ago
trusting namecoin implementation doesn't count?

stephenr 12y ago

can be really harmful, in some applications I don't need to know that my connection to lol cats is secure and uninterrupted.

harshreality 12y ago
Let's assume a simple video site and html5 video. Do you want to bet there are no vulnerabilities in your browser's mp4/vp8 decoder? If there are, anyone can MITM your non-SSL connection and compromise the video decoding process, limited only by their cleverness and by whatever sandboxing your browser employs.
- stephenr 12y ago
  Why does it have to be video? Some of the simplest sites around are plain text or text and images. Why do I need SSL or TLS to view either of these? I am very aware that anything authenticated should be carried over an encrypted connection - I'm not arguing against that. I'm saying there are use-cases that do not require it.
  - AlyssaRowan 12y ago
    Because otherwise nation-state adversaries can see everything you read. IETF position on this is pretty clear after the technical plenary last year.
    - stephenr 12y ago
      Again, why does it matter if you or Barack Obama or Kimg Jung Un knows that I like looking at Captain Picard meme pictures? How can you tell me that REQUIRES an encrypted connection? You know what might actually make some fucking sense. Enforce SSL/TLS where it is needed - disable HTTP Auth, Cookies, Location Services, Local Storage, etc over plain HTTP connections.
rakoo 12y ago
Do you want your location along with your credentials to your lol cats forum in the wild ? Depending on what site you're going to, you can be screwed pretty easily.
- stephenr 12y ago
  I didn't mention credentials. Plenty of web use is anonymous, and has 0 need for SSL/TLS
  - AlyssaRowan 12y ago
    Counterexample: If you want it to be anonymous, you need TLS (and Tor!).
    - stephenr 12y ago
      Well I'm glad you're able to miss the fucking point with such efficiency
  - rakoo 12y ago
    You don't need credentials to be identified, your browser can be identified quite accurately (see https://panopticlick.eff.org/ https://panopticlick.eff.org/).