5 ms·

I wonder if we can ever look forward to a day when unencrypted http just doesn't exist. When the only option is https?

userbinator 12y ago
I'm in favour of encryption for protecting sensitive data (TripIt is violating this principle), but don't think it should be needed for publicly accessible information. The centralised CA model is probably one of my biggest gripes about using HTTPS.
- fabulist 12y ago
  CAs are unfortunate, but the reality is that all data is sensitive to some degree. TripIt's data is more sensitive than, say, which Wikipedia article I'm reading, but that still gives away a huge amount of information about what my current thought process is and where its going. The only way to avoid the dragnet surveillance we're currently experiencing is to take away the opportunity.
  - MichaelGG 12y ago
    And an attack can also modify data. Even "public" data, like Wikipedia info, could be valuable to modify. You can attack a user that way by providing misleading information. Or carry out XSS-like attacks. Or just insert spammy links or redirections all over the page.
- daigoba66 12y ago
  TLS is more than just encryption; it's also a mechanism that enables you to, in theory, verify that the content is from the source it says it's from.
  - CWuestefeld 12y ago
    As I see it, that is actually the problem here. As things stand, if you don't have the resources to go through the process for proving your identity (or have other reasons for not wanting to do so) to establish the certificate, then you are unable to have encryption, or at least not without raising an error message in your users' browsers.
    - nknighthb 12y ago
      The cheap certificates are domain-controlled, meaning that "proving your identity" is just "proving control of the domain name", such as by clicking a link in an email sent to a listed whois contact address. If you can't prove control of the domain, you absolutely should not be issued a certificate for it under any circumstances.
blueskin_ 12y ago
Only if the CAs relinquish their monopoly position.

I'm in favour of encryption for protecting sensitive data (TripIt is violating this principle), but don't think it should be needed for publicly accessible information. The centralised CA model is probably one of my biggest gripes about using HTTPS.

fabulist 12y ago
CAs are unfortunate, but the reality is that all data is sensitive to some degree. TripIt's data is more sensitive than, say, which Wikipedia article I'm reading, but that still gives away a huge amount of information about what my current thought process is and where its going. The only way to avoid the dragnet surveillance we're currently experiencing is to take away the opportunity.
- MichaelGG 12y ago
  And an attack can also modify data. Even "public" data, like Wikipedia info, could be valuable to modify. You can attack a user that way by providing misleading information. Or carry out XSS-like attacks. Or just insert spammy links or redirections all over the page.
daigoba66 12y ago
TLS is more than just encryption; it's also a mechanism that enables you to, in theory, verify that the content is from the source it says it's from.
- CWuestefeld 12y ago
  As I see it, that is actually the problem here. As things stand, if you don't have the resources to go through the process for proving your identity (or have other reasons for not wanting to do so) to establish the certificate, then you are unable to have encryption, or at least not without raising an error message in your users' browsers.
  - nknighthb 12y ago
    The cheap certificates are domain-controlled, meaning that "proving your identity" is just "proving control of the domain name", such as by clicking a link in an email sent to a listed whois contact address. If you can't prove control of the domain, you absolutely should not be issued a certificate for it under any circumstances.

blueskin_ 12y ago

Only if the CAs relinquish their monopoly position.