4 ms·

It's not that I disagree, so much as I consider dropping auth completely to be pretty much a complete waste of time - it solves virtually none if not none of th

by mSparks 12y ago

It's not that I disagree, so much as I consider dropping auth completely to be pretty much a complete waste of time - it solves virtually none if not none of the problems. What would be a minimum imho is a "persistence" authentication. i.e. I don't need to know that Anonymous123 is really joe bloggs of Boston. What I do need to be reasonably sure of is that Anonymous123 is the same Anonymous123 that I was talking to last week. I don't even really care if someone sits and listens in to the conversation - the weak link in encryption imho is that it isn't anonymous. And in that context - tor solves most of these problems already.

rakoo 12y ago
> it solves virtually none [of the problems] Consider this: in today's HTTP, the communication between the user and the server is for everyone to see. With HTTPS, the communication is private between the user and _a_ server. I believe only the NSA has accurate numbers, but I guess a whole lot of the servers users are talking to are the correct one. Authentication comes _on top of that_ so we can predict this number with more accuracy. But you may not need to; maybe your conversation really is public, maybe you don't care. The thing is that we actually _can_ make it so that everyone can be happy with that: those who expect a minimum of privacy and those who don't. We can provide encryption; it's easy and cheap. It doesn't mean the communication is 100% secure (it never is), but it means it's fare better than what we have today. We must do it. Again, it doesn't mean communications will be secure, and browsers should certainly not display unauthenticated encrypted communications with the reassuring green lock; it means they should show _all_ HTTP connections as completely insecure and unauthenticated HTTPS connections as mildly secure. By the way, your model is called Trust On First Use or TOFU [0] and is already used in some crypto domains, most notably ssh. [0] https://en.wikipedia.org/wiki/User:Dotdotike/Trust_Upon_First_Use https://en.wikipedia.org/wiki/User:Dotdotike/Trust_Upon_Firs...
- mSparks 12y ago
  Or just use tor browser...

by mSparks 12y ago

rakoo 12y ago

> it solves virtually none [of the problems] Consider this: in today's HTTP, the communication between the user and the server is for everyone to see. With HTTPS, the communication is private between the user and _a_ server. I believe only the NSA has accurate numbers, but I guess a whole lot of the servers users are talking to are the correct one. Authentication comes _on top of that_ so we can predict this number with more accuracy. But you may not need to; maybe your conversation really is public, maybe you don't care. The thing is that we actually _can_ make it so that everyone can be happy with that: those who expect a minimum of privacy and those who don't. We can provide encryption; it's easy and cheap. It doesn't mean the communication is 100% secure (it never is), but it means it's fare better than what we have today. We must do it. Again, it doesn't mean communications will be secure, and browsers should certainly not display unauthenticated encrypted communications with the reassuring green lock; it means they should show _all_ HTTP connections as completely insecure and unauthenticated HTTPS connections as mildly secure. By the way, your model is called Trust On First Use or TOFU [0] and is already used in some crypto domains, most notably ssh. [0] https://en.wikipedia.org/wiki/User:Dotdotike/Trust_Upon_First_Use https://en.wikipedia.org/wiki/User:Dotdotike/Trust_Upon_Firs...

mSparks 12y ago
Or just use tor browser...