3 ms·
> AMO doesn't do any code signing for extensions, so they're only protected by HTTPS. As we saw with Heartbleed, SSL private keys can be compromised. I find it
by johannh 12y ago
> AMO doesn't do any code signing for extensions, so they're only protected by HTTPS. As we saw with Heartbleed, SSL private keys can be compromised.
I find it quite ironic that HTTPS Everywhere is arguing HTTPS is not safe enough to offer them a reasonable guarantee of integrity.
- kofalt 12y agoShouldn't be terribly surprising: http://dayswithoutansslexploit.com http://dayswithoutansslexploit.com HTTPS might be better than getting a website in cleartext, but you'd have to be a madman to claim that HTTPS is safe, sane, or secure.
- johannh 12y agoTrue, I'm not surprised at all. HTTPS Everywhere-like functionality should be integrated into browsers and not a downloadable extra, tricking people into feeling fully secured.
- toomuchtodo 12y agoWhile not "everywhere"... Force SSL only: http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security Have site preloaded in Chrome: https://hstspreload.appspot.com https://hstspreload.appspot.com
- mbrubeck 12y agoFirefox also has a built-in HSTS preload list, which I believe uses the Chrome list as one of its inputs: https://blog.mozilla.org/security/2012/11/01/preloading-hsts/ https://blog.mozilla.org/security/2012/11/01/preloading-hsts...
- geofft 12y agoHTTPS is a lower bound of reasonable security, not an upper one. The argument for HTTPS _everywhere_ is that it's the smallest possible thing you can do to make yourself slightly secure. Would you find it ironic that someone selling combination locks for gym lockers wants a better lock on their storefront?
- riquito 12y ago> Would you find it ironic that someone selling combination locks for gym lockers wants a better lock on their storefront? More like he wants to add additional security measures because the lock isn't secure enough. I wouldn't buy a lock then.
- philtar 12y agoIt's called layering. Nothing is 100% secure.
- johannh 12y agoI find it ironic if banks and post offices are using combination locks as advertised security measures but the people selling those install steel doors on their storefront.