It surprises me how often Betteridge's law of headlines is true
> Any headline that ends in a question mark can be answered by the word no.
https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline...
Is This Site Secure?
21–30 of 51 posts
Re: Is This Site Secure?
#22This site also invites me to run a pile of code shipped from it: http://www.kermitproject.org/ckscripts.html
-- so yes, it matters that I'm actually talking to kermitproject, and they should go get a LE cert.
Re: Is This Site Secure?
#23While at the begining I thought I sensed a bigger argument here, the further I read I am certain the author either prefers to discount MITM or lacks the understanding of the full scope of a MITM. I agree that there are other evils of the web but that does not mean we make trade-offs. The last paragraph goes as far as to say "The ad is not from the website; rather, it is inserted into the datastream — after it has lef…
I don't agree with the article (mainly because I consider that switching to https is free enough for anyone doing web hosting), but still, the point is pretty clear. https feels like red herring.
When we say "MITM" who is this man? In most cases, the only two valid responses really are "my ISP", and "the service's hosting provider".
https doesn't securize against evil hosting provider.
When using Chrome+https, vs Firefox+http, in one case you give your data to your ISP, in the other case to Google.
Google's primary focus is using my personal data. My ISP's primary focus is giving me Internet. Google is making fuss about https, to feed noise about Google itself.
Yes, I totally agree that best is to simply Firefox https. Yes, I'm totally dismissing the issue of rogue networks. But >80% of the population uses Google, I believe that less than 20% of the population is using rogue networks. What about the issue of broken WiFi security? Well, the point stands: https is so much of a red herring, that everyone forgets to fix WiFi.
Re: Is This Site Secure?
#24My own website is on HTTP because I mainly edit it and browse it on old computers where modern encryption is not available[0]. I assumed it would be the same reasoning here, as who else is using Kermit in 2020?
Is anyone here using Kermit? Would love to know what for. Website seems to suggest it's for embedded systems, but I've only seen TFTP used in those cases.
[0] http://www.kalleboo.com/retrotech/screenshots/powerbook-145b...
Re: Is This Site Secure?
#25While at the begining I thought I sensed a bigger argument here, the further I read I am certain the author either prefers to discount MITM or lacks the understanding of the full scope of a MITM. I agree that there are other evils of the web but that does not mean we make trade-offs. The last paragraph goes as far as to say "The ad is not from the website; rather, it is inserted into the datastream — after it has lef…
I don't agree with the article (mainly because I consider that switching to https is free enough for anyone doing web hosting), but still, the point is pretty clear. https feels like red herring. When we say "MITM" who is this man? In most cases, the only two valid responses really are "my ISP", and "the service's hosting provider". https doesn't securize against evil hosting provider. When using Chrome+https, vs Fir…
The man is also the hacker on the coffee shop WiFi intercepting traffic.
Re: Is This Site Secure?
#26> Probably browser makers like Google get "rewards" from the security companies for adding this feature.
This seems like quite a jump to me, and it underpins his entire argument. Is there any evidence of this?
Re: Is This Site Secure?
#27Earlier quoted context omitted.
No they wouldn't, because this is trivially easy to MITM. The whole reason CAs exist is to verify the identity of the domain owner, because any random MITMer can claim to be yourbank.com and you can't prove it either way. Very technically this would be slightly better because it stops passive observers, but in reality I suspect it would be worse because tons of websites would use this broken by design solution and th…
There are two aspects that are currently adressed by https: identity and privacy. What I’m proposing does indeed only solve the privacy aspect. And for some use-cases, that’s fine. Not all use-cases (e.g. your bank), and we would still have CAs for that.
Having private communication without knowing who you're talking to is not private at all. You need to first define who you want to hide the communication from (assumedly, everyone except the server in question), and then also know that you're really talking to that server and not just someone claiming to be that server.
For example, if there were a class of websites where certificates were not checked, I could configure my router to man-in-the-middle attack every connection to one of those coming from anywhere in my own network, and then re-transmit information in the clear somewhere else. To someone inside my network, their browser would report their connection as being "secure".
Re: Is This Site Secure?
#28While at the begining I thought I sensed a bigger argument here, the further I read I am certain the author either prefers to discount MITM or lacks the understanding of the full scope of a MITM. I agree that there are other evils of the web but that does not mean we make trade-offs. The last paragraph goes as far as to say "The ad is not from the website; rather, it is inserted into the datastream — after it has lef…
If unencrypted data in transit and an open man-in-the-middle attack vector are "definitely not a security risk", I cannot trust the author's concept of security, risk, or privacy.
Re: Is This Site Secure?
#29Earlier quoted context omitted.
> How can I know if the site I see is REALLY your site without https? HTTPS has never been about non-repudiation or authenticity; it's always been about confidentiality. You get some half-assed "authenticity" if you didn't mistyped the domain, and your clock is correctly set, and the certificate authority wasn't compromised, and the web server wasn't compromised, etc. You should use GPG or signify if you need authent…
Non-repudiation and authenticity are terms of art. By redefining them well outside of what everyone else means by those terms, I don't think you're helping discourse along. HTTPS _absolutely_ guarantees non-repudiation and authenticity. Casually dismissing the most important protocol on the Internet as giving you some "half-assed authenticity" is pretty silly, especially when one of your suggested alternatives is GPG…
> HTTPS _absolutely_ guarantees non-repudiation and authenticity
No it doesn't. Correct HTTPS (i.e. connecting to a site with no errors) guarantees:
* the entity that requested the certificate at the date it did had control over either the website or the DNS for a domain (if it is domain-squatting, it's even legal)
* the Certificate Authority that did deliver that certificate did not suffer a breach; and otherwise followed protocol (CAA - which might be under attack, etc.)
* the client connecting did either: not check for revocation (often), not encounter errors while checking, or silently ignored the absence of reply when asking for the CRL/OCSP responder
And it's precisely because HTTPS doesn't guarantee any kind of authenticity that browsers themselves are dropping visual clues for EV certificates. [0]
[0] https://www.troyhunt.com/extended-validation-certificates-ar...
Re: Is This Site Secure?
#30> Probably browser makers like Google get "rewards" from the security companies for adding this feature. This seems like quite a jump to me, and it underpins his entire argument. Is there any evidence of this?
Isnt it the opposite that googles policy of showing same icon for DV and EV certificates are making it a lot more difficult for security companies to make money selling expensive EV certs?