3 ms·

I'm a fan of plain text protocols but I think the web has gotten to the point were the adversaries are so intrusive and powerful that it all needs to be encrypt

by guelo 12y ago

I'm a fan of plain text protocols but I think the web has gotten to the point were the adversaries are so intrusive and powerful that it all needs to be encrypted, including the headers. For example, HTTP2 will stop ISP header injection such as this: http://www.propublica.org/article/somebodys-already-using-verizons-id-to-track-users?hn http://www.propublica.org/article/somebodys-already-using-ve...

jacquesm 12y ago
https would stop injection just the same and is just http-over-ssl/tls. You could also simply sign the the content (but that would still allow wire-tapping). Both still leave the original text based protocol and would stop ISP header injection. Another defense against such trickery would be a legal one: make it illegal to tamper with data sent between two peers on the internet. Imagine the postal service opening your mail and changing a couple of words in your mail just because they could.
- haberman 12y ago
  > Both still leave the original text based protocol and would stop ISP header injection. SSL is not a text-based protocol.
  - jacquesm 12y ago
    Neither is TCP, but that's just a wrapper. Inside the SSL/TLS wrapper it is still just HTTP. It's no longer 'in the clear' but it is still very much a text based protocol.
    - haberman 12y ago
      And HTTP2 is essentially just a multiplexed wrapper around HTTP1-like semantics, AFAICS. I'm not an HTTP2 expert, but I would bet that WireShark can make an HTTP2 session look basically the same as a bunch of HTTP1 requests. It's the same "wrapper" concept except it adds multiplexing.
      - MichaelGG 12y ago
        Yeah and once you multiplex, your text based protocol is gonna suck to read anyways. So in practice you'll use Wireshark, and then you no longer care if it's text based.
deleted 12y ago
[deleted]
nly 12y ago
HTTP/2 won't stop anything. Encryption is not mandatory. Even if it were, browsers are going to be defaulting to HTTP 1.x on port 80 for perhaps a decade. Transparent proxying and downgrade attacks are still totally feasible. Just like every other step in Internet history, user security and privacy has been kicked to the curb.

by guelo 12y ago

jacquesm 12y ago

https would stop injection just the same and is just http-over-ssl/tls. You could also simply sign the the content (but that would still allow wire-tapping). Both still leave the original text based protocol and would stop ISP header injection. Another defense against such trickery would be a legal one: make it illegal to tamper with data sent between two peers on the internet. Imagine the postal service opening your mail and changing a couple of words in your mail just because they could.

haberman 12y ago
> Both still leave the original text based protocol and would stop ISP header injection. SSL is not a text-based protocol.
- jacquesm 12y ago
  Neither is TCP, but that's just a wrapper. Inside the SSL/TLS wrapper it is still just HTTP. It's no longer 'in the clear' but it is still very much a text based protocol.
  - haberman 12y ago
    And HTTP2 is essentially just a multiplexed wrapper around HTTP1-like semantics, AFAICS. I'm not an HTTP2 expert, but I would bet that WireShark can make an HTTP2 session look basically the same as a bunch of HTTP1 requests. It's the same "wrapper" concept except it adds multiplexing.
    - MichaelGG 12y ago
      Yeah and once you multiplex, your text based protocol is gonna suck to read anyways. So in practice you'll use Wireshark, and then you no longer care if it's text based.

deleted 12y ago

[deleted]

nly 12y ago

HTTP/2 won't stop anything. Encryption is not mandatory. Even if it were, browsers are going to be defaulting to HTTP 1.x on port 80 for perhaps a decade. Transparent proxying and downgrade attacks are still totally feasible. Just like every other step in Internet history, user security and privacy has been kicked to the curb.