3 ms·
In addition to thwarting state-sponsored attacks mentioned by geofft, HTTPS also prevents ISPs and hotels from injecting ads[1,2]. And using HTTPS even for log
by agwa 12y ago
In addition to thwarting state-sponsored attacks mentioned by geofft, HTTPS also prevents ISPs and hotels from injecting ads[1,2]. And using HTTPS even for logged-out users prevents an attacker from sslstripping[3] the link to the login page, which is good because even the most careful users won't always notice when a login page is suddenly served over an insecure connection.
As a user of HN, I appreciate these security features. Suggesting that HN should not use HTTPS so that someone can access it from a 10 year old device that's impractical for modern web browsing anyways is possibly the weakest argument you can make against HTTPS.
[1] http://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-for-hs-ok/ http://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-f...
[2] http://justinsomnia.org/2012/04/hotel-wifi-javascript-injection/ http://justinsomnia.org/2012/04/hotel-wifi-javascript-inject...
[3] http://www.thoughtcrime.org/software/sslstrip/ http://www.thoughtcrime.org/software/sslstrip/
- deleted 12y ago[deleted]
- roywiggins 12y agoT-Mobile opted me in to a content filter by default. To remove it, last I saw I needed to give them my SSN (!!!). So, I live with the idiot filter, which actually scans for keywords in websites and blocks them. SSL obviously makes this sort of filtering useless, which is very useful.
- CamperBob2 12y agoWow. This is in the US, I assume ("SSN")? I've never heard of this happening with a US carrier.
- ChristianBundy 12y agoYeah, social security number. It's basically a private key we're all assigned at birth that can't be rotated. It was originally meant to be used in the state-sponsored welfare program "social security", but tons of businesses require it as a unique identifier. Absolute stupidity on all fronts.
- gknoy 12y agoI'm pretty certain you can ask them for a random number instead, as only the government is allowed (last I recall) to __require__ an SSN. I know my doctors can ask for it, but are required to accept an alternative if I don't wish to provide the SSN. For example: http://www.identityhawk.com/Who-Can-Lawfully-Request-My-Social-Security-Number http://www.identityhawk.com/Who-Can-Lawfully-Request-My-Soci... Sadly, it's too late in the day for me to try to parse this: http://www.justice.gov/opcl/social-security-number-usage http://www.justice.gov/opcl/social-security-number-usage
- grandalf 12y agoWhy not give them your SSN? Do you have any lines of credit?
- carlob 12y agoHappened to me as well when I was visiting the US. My answer would be: because as a non-resident I didn't have one. But then again I'm not OP.
- michaelmior 12y agoThis doesn't completely stop sslstripping. It does mitigate the possibility of link rewriting. However, unless you directly access the site via HTTPS, there would have to be a redirect to the secure version, which can still be hijacked.
- agwa 12y agoTrue, but HSTS (which HN uses) solves that problem on all but the first visit.
- michaelmior 12y agoIndeed. But not on the Treo ;)