81–90 of 102 posts
Earlier quoted context omitted.
Your headers would still be unencrypted -- including the domain and URL you accessed.
The domain is unencrypted over HTTPS, but the path is encrypted.
"...I care about my own privacy and security..." and yet your website has no encryption. Thus, when I enter my details on your form, it is being passed over the same internet in plaintext, thereby violating the exact "privacy and security" this "protest" aims to create.
The form action appears to use https. But yeah, it is 2016 and https should be the norm for even just loading pages with forms.
Of course I could just throw cloudflare in front of everything, but no thank you.
Earlier quoted context omitted.
This is an excellent argument for setting up e-mail using your own domain name, though, and for using that for all new accounts and transitioning existing accounts to your new e-mail address as soon as possible. The Internet works just fine when it's decentralised, but particularly with e-mail, relying on the big service providers (or an ISP-provided address, for that matter) immediately locks you into someone else's…
Although that also introduces risks. Losing control over your domain would be problematic. It happens. The argument for individual domains suggests itself, or an equivalent follows-the-person mechanism.
It is extremely difficult to unintentionally lose control of a domain that you legitimately register with a respectable registrar.
Any centralised service you use for free can terminate your account on a whim any time they like, give access to an account you used to use to anyone else they like, and so on.
There is some non-zero level of risk in any dealing with a remote service, but I don't think the scale of risk in these two scenarios is even remotely comparable.
Earlier quoted context omitted.
Although that also introduces risks. Losing control over your domain would be problematic. It happens. The argument for individual domains suggests itself, or an equivalent follows-the-person mechanism.
Yes! Reducing the risk of losing control of the domain is a great reason to prefer gmail.com, outlook.com, or another similarly theft-hard mail domain. Otherwise, if an attacker can trick the registrar or nameserver, it's game-over for all accounts that use mail or mail-dependent factors for authentication.
That's a mighty big "if", though. For any of the TLDs I'm familiar with, there are significant protections against unintended domain transfers, and that has been the case for a long time for the major ones.
Earlier quoted context omitted.
The form action appears to use https. But yeah, it is 2016 and https should be the norm for even just loading pages with forms.
I host 20 sites from simple vps box with nginx. AFAIK i need an ip per domain to have ssl, unless I use something called sni, but I don't know how to set it up with nginx + let'sencrypt It's not that easy. Of course I could just throw cloudflare in front of everything, but no thank you.
Yahoo is simply the first company that we publicly know of that scans incoming emails. If the government can force Yahoo, they will force all of them. Yahoo has more disgruntled former employees to reveal secrets than Google, Microsoft, etc...
The issue I have is that Yahoo evidently didn't even fight the order. Even if they thought they would lose, they should have at least attempted it. Or maybe they decided it was better to make money selling us out?
Well... then you should dump your phone too because the government has direct access to all telecom networks. By law! no spying necessary.
Earlier quoted context omitted.
I host 20 sites from simple vps box with nginx. AFAIK i need an ip per domain to have ssl, unless I use something called sni, but I don't know how to set it up with nginx + let'sencrypt It's not that easy. Of course I could just throw cloudflare in front of everything, but no thank you.
Hmm? I run multiple https sites from a single Linode box without any issues. Nginx + letsencrypt.