There is a big reason left out of his argument: privacy of the user who is reading the page. Essentially non-existing on HTTP.
Is This Site Secure?
11–20 of 51 posts
Re: Is This Site Secure?
#12Another reminder that we should fight for encryption by default, without requiring a validated certificate. Just self-signed like most end-ro-end encryption schemes. For such sites, browsers could not display a padlock to differentiate them from validated certificates (DV/EV). Thus without any additional configuration, the data sent over those connections would be safe.
No they wouldn't, because this is trivially easy to MITM. The whole reason CAs exist is to verify the identity of the domain owner, because any random MITMer can claim to be yourbank.com and you can't prove it either way. Very technically this would be slightly better because it stops passive observers, but in reality I suspect it would be worse because tons of websites would use this broken by design solution and th…
That's what TLS 1.3 is all about. It has a very limited suite of ciphers instead of 1.2's "throw everything at a wall and see what happens".
Re: Is This Site Secure?
#13> So Internet security has become a big and ongoing business, which has to be paid for. If I want to have a secure E-commerce site so I can make money, I have buy security services on top of the basic web services: an HTTPS address instead of the original HTTP: — OK, fair enough. Has this guy not heard of Let's Encrypt? HTTPS certificates are literally free. I was astounded when I got to the end of the article and sa…
He is probably assuming that e-commerce sites must/should use EV certificates. It could be an additional trust source but how many users really care that the cert is EVed.
Re: Is This Site Secure?
#14> So Internet security has become a big and ongoing business, which has to be paid for. If I want to have a secure E-commerce site so I can make money, I have buy security services on top of the basic web services: an HTTPS address instead of the original HTTP: — OK, fair enough. Has this guy not heard of Let's Encrypt? HTTPS certificates are literally free. I was astounded when I got to the end of the article and sa…
It's even more interesting that they seem to be working with a file-transfer protocol. It seems to me like they should be experts in this field, and clearly not aware of Let's Encrypt.
Im confused.
Re: Is This Site Secure?
#15> So Internet security has become a big and ongoing business, which has to be paid for. If I want to have a secure E-commerce site so I can make money, I have buy security services on top of the basic web services: an HTTPS address instead of the original HTTP: — OK, fair enough. Has this guy not heard of Let's Encrypt? HTTPS certificates are literally free. I was astounded when I got to the end of the article and sa…
He is probably assuming that e-commerce sites must/should use EV certificates. It could be an additional trust source but how many users really care that the cert is EVed.
But hes not arguing against EVs (that argument would be very valid).
Re: Is This Site Secure?
#16Another reminder that we should fight for encryption by default, without requiring a validated certificate. Just self-signed like most end-ro-end encryption schemes. For such sites, browsers could not display a padlock to differentiate them from validated certificates (DV/EV). Thus without any additional configuration, the data sent over those connections would be safe.
No they wouldn't, because this is trivially easy to MITM. The whole reason CAs exist is to verify the identity of the domain owner, because any random MITMer can claim to be yourbank.com and you can't prove it either way. Very technically this would be slightly better because it stops passive observers, but in reality I suspect it would be worse because tons of websites would use this broken by design solution and th…
There are two aspects that are currently adressed by https: identity and privacy. What I’m proposing does indeed only solve the privacy aspect. And for some use-cases, that’s fine. Not all use-cases (e.g. your bank), and we would still have CAs for that.
Re: Is This Site Secure?
#17Seriously? And what about Man-in-the-middle attacks? I mean come on, there are files to download from that website? How can I know if the site I see is REALLY your site without https? Really, I don't know why you just don't obtain a Let's Encrypt certificate, it's not difficult anymore...
> How can I know if the site I see is REALLY your site without https? HTTPS has never been about non-repudiation or authenticity; it's always been about confidentiality. You get some half-assed "authenticity" if you didn't mistyped the domain, and your clock is correctly set, and the certificate authority wasn't compromised, and the web server wasn't compromised, etc. You should use GPG or signify if you need authent…
Confidentiality without authentication is not a thing. If I don't know that I'm talking to you, then I might be talking to a MITM attacker who's reading everything we're saying (and may or may not be altering it). It really is that simple.
Re: Is This Site Secure?
#18Another reminder that we should fight for encryption by default, without requiring a validated certificate. Just self-signed like most end-ro-end encryption schemes. For such sites, browsers could not display a padlock to differentiate them from validated certificates (DV/EV). Thus without any additional configuration, the data sent over those connections would be safe.
You walk into a random corner store for Tylenol and see the bottom of a cut-off box of cereal with pills inside. A cardboard sign in front of it says "Tylenol" and there's a logo clearly printed off a website gluesticked to the box. The pills are plausibly the right shape and color.
You buy a few and take your Tylenol without a second thought—right?
Maybe not. If that seems ill-advised, please don't propose the same for websites.
Re: Is This Site Secure?
#19Seriously? And what about Man-in-the-middle attacks? I mean come on, there are files to download from that website? How can I know if the site I see is REALLY your site without https? Really, I don't know why you just don't obtain a Let's Encrypt certificate, it's not difficult anymore...
> How can I know if the site I see is REALLY your site without https? HTTPS has never been about non-repudiation or authenticity; it's always been about confidentiality. You get some half-assed "authenticity" if you didn't mistyped the domain, and your clock is correctly set, and the certificate authority wasn't compromised, and the web server wasn't compromised, etc. You should use GPG or signify if you need authent…
Non-repudiation and authenticity are terms of art. By redefining them well outside of what everyone else means by those terms, I don't think you're helping discourse along. HTTPS _absolutely_ guarantees non-repudiation and authenticity. Casually dismissing the most important protocol on the Internet as giving you some "half-assed authenticity" is pretty silly, especially when one of your suggested alternatives is GPG, which literally can not get a damn MAC right in any mode actually deployed anywhere and instead has some weird superstitious MDC nonsense.
Re: Is This Site Secure?
#20Earlier quoted context omitted.
No they wouldn't, because this is trivially easy to MITM. The whole reason CAs exist is to verify the identity of the domain owner, because any random MITMer can claim to be yourbank.com and you can't prove it either way. Very technically this would be slightly better because it stops passive observers, but in reality I suspect it would be worse because tons of websites would use this broken by design solution and th…
There are two aspects that are currently adressed by https: identity and privacy. What I’m proposing does indeed only solve the privacy aspect. And for some use-cases, that’s fine. Not all use-cases (e.g. your bank), and we would still have CAs for that.
How does it solve the privacy aspect if I can MITM it and replay the second half of the conversation to the real party?