4 ms·
Let's assume a simple video site and html5 video. Do you want to bet there are no vulnerabilities in your browser's mp4/vp8 decoder? If there are, anyone can
by harshreality 12y ago
Let's assume a simple video site and html5 video.
Do you want to bet there are no vulnerabilities in your browser's mp4/vp8 decoder? If there are, anyone can MITM your non-SSL connection and compromise the video decoding process, limited only by their cleverness and by whatever sandboxing your browser employs.
- stephenr 12y agoWhy does it have to be video? Some of the simplest sites around are plain text or text and images. Why do I need SSL or TLS to view either of these? I am very aware that anything authenticated should be carried over an encrypted connection - I'm not arguing against that. I'm saying there are use-cases that do not require it.
- AlyssaRowan 12y agoBecause otherwise nation-state adversaries can see everything you read. IETF position on this is pretty clear after the technical plenary last year.
- stephenr 12y agoAgain, why does it matter if you or Barack Obama or Kimg Jung Un knows that I like looking at Captain Picard meme pictures? How can you tell me that REQUIRES an encrypted connection? You know what might actually make some fucking sense. Enforce SSL/TLS where it is needed - disable HTTP Auth, Cookies, Location Services, Local Storage, etc over plain HTTP connections.