401–410 of 419 posts
Earlier quoted context omitted.
I'm not sure what the "driving" equivalent is for a battleship, but I'm pretty sure you do that to a server, not drive it. Commandeer?
Commandeering web servers will probably get you arrested ಠ_ಠ I don't know what you do with a battleship. Helm it, maybe?
Earlier quoted context omitted.
Actually, Cloudflare offer you certs they sign (which wouldn't be trusted by others, but they verify), that you can use to encrypt from the server to them. You still have to trust Cloudflare, but it's not plain text from cloudflare to your server. If you mean the case where you literally can't serve under HTTPS, it's not just getting the cert that is the problem, in most cases running a local proxy of something that…
Wouldn't he still have to install the Cloudflare certs on his server then? In that case why not get LetsEncrypt?
Earlier quoted context omitted.
Cloudflare will provide you with certificates they generate, that they verify but won't be accepted by anyone else. (No cost because of that) - this keeps the data secure between you are them. Obviously, you are still trusitng cloudflare in the middle, but still less trust required.
If you can install a certificate, you can already get a real one from Lets Encrypt (you don't actually need to run their client on the server). The problem is that many shared hosting services are still stuck in the past, and don't let you use SSL/TLS at all.
I agree that the best option is for shared hosts just to build in support for LetsEncrypt.
Earlier quoted context omitted.
You only get a valid certificate for your router's address. Considering basically every router has the same address, I now have a valid certificate for basically every router.
Considering basically every router has the same address They have the same IP address, not necessarily the same DNS hostname, which is what the certificates are tied to. The user would just be told to connect to the hostname (possibly printed in the sticker) rather than to the IP.
There is no option for any of this that isn't completely messy and hacky
Earlier quoted context omitted.
Considering basically every router has the same address They have the same IP address, not necessarily the same DNS hostname, which is what the certificates are tied to. The user would just be told to connect to the hostname (possibly printed in the sticker) rather than to the IP.
That's certainly one option, but what happens now if I change the IP of the router in its config, because I use multiple in my LAN, one as router, the others as AP? There is no option for any of this that isn't completely messy and hacky
As a bonus, the user doesn't have to change anything to keep accessing the router admin page after the switch.
Earlier quoted context omitted.
that's exactly my point. I am hoping/assuming chrome would notify the user about this as well.
Why? IIRC cross-origin will prevent the http page from reaching into the https iframe and furthermore the password is being sent over https so google doesn't really care.
Earlier quoted context omitted.
Why? IIRC cross-origin will prevent the http page from reaching into the https iframe and furthermore the password is being sent over https so google doesn't really care.
But since top lev is insecure, an attacker could inject a legit looking form whose destination is set to steal passwords.
Earlier quoted context omitted.
Yes. Every website. Because if only the sensitive sites are strongly encrypted, then bad actors and authorities know exactly where to focus their efforts in trying to steal information. When everyone is strongly encrypted, attackers are stretched much more thinly. Besides, it's easy and free these days. Unless, apparently, you use some crappy shared hosting provider. Get a VPS, man! They're cheap!
How cheap? Would you have a suggestion? Thanks.
I use DigitalOcean now for almost all of my sites. I have abandoned wordpress lately and so I am using custom built sites for all my projects. DigitalOcean is awesome.
Earlier quoted context omitted.
If you can install a certificate, you can already get a real one from Lets Encrypt (you don't actually need to run their client on the server). The problem is that many shared hosting services are still stuck in the past, and don't let you use SSL/TLS at all.
Without running the client, that means manually changing the cert for expiry, which is very short on LetsEncrypt certs. That introudces the possibility of forgetting or messing it up. I agree that the best option is for shared hosts just to build in support for LetsEncrypt.
Earlier quoted context omitted.
Honest question, who is in a position to tap your connection such that this becomes a serious security concern? IT staff at your company? The admins at your ISP? The NSA? I'm assuming that public wifi has session-specific encryption keys. I don't see these as the kinds of concerns that would warrant the kind of panic that some people seem to show over HTTP.
Your assumption about public wifi is wrong. If you connect without a password, your traffic is sent in the clear and MITM attacks are trivial. If you don't want your password exposed to any hacker with an old Pringles can within a mile of your location, you need end to end crypto.