4 ms·
Then your issue is with sites that host content on http, and the solution is to address the content hosts—not deprecate a protocol. Besides, If you can MITM htt
by josho 12y ago
Then your issue is with sites that host content on http, and the solution is to address the content hosts—not deprecate a protocol. Besides, If you can MITM http then you can probably do the same for DNS, so https doesn't really solve the attack vector you mention.
Finally, Read this thread for use cases for http. They may not apply for you, but are sufficient that I think we can keep http around for awhile longer.
- IgorPartola 12y agoThere are no use cases where HTTP is more capable than HTTPS. There are some hurdles in dropping HTTP, but HTTPS is a strict improvement for almost all cases. The only argument I can see for plain HTTP is legacy devices that no longer receive updates. For these, a UI similar to the self-signed cert warning will work. My problem is that we still allow plain HTTP. That should never be the case, just like we should not use telnet for remote server access. DNS hijacking is a problem. It is a problem at a different layer of the system. Just because that layer is vulnerable, does not mean that we should leave a gaping security hole at a different layer. I don't buy the argument that we must have perfect security or no security. Besides, there are ways to mitigate the DNS hijacking issue, such as the HSTS header.