441–450 of 525 posts
What prevents LetsEncrypt from censoring entire domains by refusing to renew their short-lived certificate?
Earlier quoted context omitted.
The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website. Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. I didn’t use to think like this until I actually tried it out by going to a mall an…
Funny how "security experts" here complain about accidental non-repudiation misfeature of DKIM, but apparently being forced to do a bunch of crazy crap HTTPS forces you to do when all you need is content signature verification is perfectly fine with those same people. Security is becoming a field dominated by some bizarre corporate ideology.
I'm merely pointing out what is in my humble opinion, even when no sensitive data is traveling, the main reason why HTTPS should be everywhere. If you believe there are other easy to deploy and maintain solutions with the same amount of relevant user outreach, then by all means suggest them.
(I could of course point other reasons, like the fact that even if your website has no sensitive data it can still be scraped to build a profile of the visitor by a third party, etc).
Is there any concern for how much power LetsEncrypt holds over large swaths of the internet in a world where browsers refuse to connect using HTTP? What prevents LetsEncrypt from censoring entire domains by refusing to renew their short-lived certificate?
Earlier quoted context omitted.
Depends on the content of the website. A lot of websites wouldn't benefit at all from that assurance. A lot of blogs and random personal projects come to mind. My own blog does not care about authentication or MITM at all. It would be just an unnecessary complexity without any benefit.
It's not the websites that get that assurance. Maybe read up on it.
Earlier quoted context omitted.
The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website. Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. I didn’t use to think like this until I actually tried it out by going to a mall an…
> The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code I keep hearing this as a plausible excuse, yet I've never seen any proof of such. non-https does make it possible but has anyone got any source where someone has been victim of such attacks?
As for attacks, others have pointed out examples as well, and I can assure you you can go far with them (and often with some simple social engineering).
HTTP is just a no-no for me as a developer.
One change I'd like to see in browsers is when the user enters a domain without protocol in the url bar it interprets that as https instead of http.
Earlier quoted context omitted.
Have a look at Let's Encrypt DNS challenge. I created a DNS wildcard certificate for a subdomain I own and use it for all my internal domains. A great way to get HTTPS on non-public networks. HTTP over VPN is still weaker than HTTPS over VPN. For example HTTPS also handles authentication which HTTP doesn't. If you're outside of your VPN, a MitM could redirect you to http://my-internal-domain.example and resolve its D…
Deploying to a mix of internal devices, many of which lack the ability to easily allow automatic certificate renewal, is not trivial.
Earlier quoted context omitted.
This is exactly the https mode.
I don't think so. My proposed change only affects manually entered urls without protocol/schema. HTTP urls (entered manually or from links) would still work as expected, while https mode blocks them. I believe this change is small enough that they can make it the default, while http mode will likely remain optional for several years.
My blog doesn't have cookies, javascript, forms, no server-side, just html files, why should I go with https to avoid this discriminatory treatment?
The most prominent example is ISPs inject ads or messages. Search for "comcast injecting ads" to see some examples.