4 ms·

Adopting HTTPS is very important for the Web, but the lack of HTTPS in this case is just a red herring. The real problem is that it's way too easy to exploit s

by agwa 12y ago

Adopting HTTPS is very important for the Web, but the lack of HTTPS in this case is just a red herring. The real problem is that it's way too easy to exploit systems through the web browser. If the entire Web switched to HTTPS, government attackers would just find another way to deliver their exploits besides injection into plain text websites. Working on solving this problem is just as essential as transitioning to HTTPS.

chris_mahan 12y ago
So plain http in plain, static html (no javascript, limited css) is best then...
userbinator 12y ago
If the entire Web switched to HTTPS, government attackers would just find another way to deliver their exploits besides injection into plain text websites. Exactly. HTTPS relies on a centralised CA infrastructure, which is probably (indirectly) under the control of government anyway, so I don't see how taking away the ability to MITM plain text connections will help; and governments would prefer that their exploits be done over HTTPS since a properly-forged certificate will look "secure", and that makes the end-users more likely to blindly trust the authenticity of the content they download... it also means that firewalls and other systems designed to detect suspicious content in traffic (as much as they're derided for being used for censorship-related purposes, ones under the control of the user can be beneficial) won't catch the exploit either. I think that would be even worse. HTTP causes some suspecion of the content, but HTTPS gives the impression of being secure, decreasing the level of suspicion while implicitly forcing the user to trust the CAs. HTTPS with self-signed certificates that are exchanged in-person would probably provide the most secure authentication, but that doesn't really scale.
- Intermernet 12y ago
  I'm assuming, as there is a live PE executable modification payload listed, and Windows is supposed to throw warnings for unverified / unsigned updates and installers, that the CA infrastructure is already compromised. Either that or most Windows users still just habitually click through security warnings, which I sincerely hope is no longer the case.

by agwa 12y ago

chris_mahan 12y ago

So plain http in plain, static html (no javascript, limited css) is best then...

userbinator 12y ago

If the entire Web switched to HTTPS, government attackers would just find another way to deliver their exploits besides injection into plain text websites. Exactly. HTTPS relies on a centralised CA infrastructure, which is probably (indirectly) under the control of government anyway, so I don't see how taking away the ability to MITM plain text connections will help; and governments would prefer that their exploits be done over HTTPS since a properly-forged certificate will look "secure", and that makes the end-users more likely to blindly trust the authenticity of the content they download... it also means that firewalls and other systems designed to detect suspicious content in traffic (as much as they're derided for being used for censorship-related purposes, ones under the control of the user can be beneficial) won't catch the exploit either. I think that would be even worse. HTTP causes some suspecion of the content, but HTTPS gives the impression of being secure, decreasing the level of suspicion while implicitly forcing the user to trust the CAs. HTTPS with self-signed certificates that are exchanged in-person would probably provide the most secure authentication, but that doesn't really scale.

Intermernet 12y ago
I'm assuming, as there is a live PE executable modification payload listed, and Windows is supposed to throw warnings for unverified / unsigned updates and installers, that the CA infrastructure is already compromised. Either that or most Windows users still just habitually click through security warnings, which I sincerely hope is no longer the case.