HTTPS Everywhere will sunset in January 2023

But .local is reserved for mDNS. The correct suffix for hostnames on a home network with nothing better configured is actually ".home.arpa".

However precisely because .home.arpa domains are non-unique is is forbidden by the relevant RFC to treat it specially for security. Because with a roaming device, when out on say an public attacker controlled wifi, the name might resolve to something malicious under attacker control, and doing something automatically trusting self signed certs would make it more likely that attacks using such devices could succeed.

If a mechanism for securely identify exactly which home network you are connected to is eventually discovered, then this limitation can be lifted, with the user specifically whitelisting trusted home networks.

No, you're actually less secure without HTTP. Scenario: someone figure out how to mitm your http traffic. You visit the page:

For the first time - you're affected either way.

For the second time - if you still have the permanent redirect cached, you avoid the mitm.

Disabling your own http only helps the attacker in specific situations.

My point is that you want to "educate" visitors to never use HTTP (eg. for their bookmarks and typing the URL in), which I hope is effectively achieved by not having HTTP web site even on a connection you trust (eg. your local network) — so if you succeeded in "educating" them at least for your web site, they are similarly protected when they come back, including from another device. If they only rely on their browsers caching the permanent redirect, they are protected for a short time on the same browser.

But ultimately, browsers have to default to HTTPS for a guaranteed "protection" from the start (whether that's through HSTS preload lists or simply by defaulting to HTTPS, does not matter much).

> Now, Debian does not use HTTPS

so YES, they are still doing it.

thanks for confirming.

Anyway, how do you donwnload those PGP keys in your opinion?

http://subkeys.pgp.net/keys/ http://pgp.mit.edu/ http://keyserver.ubuntu.org

Why they do it?

because the heavy cryptographic computation this way is done on the client, saving computer cycles on the packages mirrors that more often than not are kept alive by volunteers using their own money and time.

> If your website is accessible to normal browsers on the public Internet, than you're not on a network where that's not possible.

*If you are running a network where that's not possible,*

again, thanks for confirming it.

anyway, I could not care about MITM attacks if my website is my personal blog, running on a PI in my living room.

It's the network job to ensure security from MITM, not the website owners'.

> Most free hosts I've looked at recently from Github pages to Netlify have automatic background SSL management for free with zero configuration from the user

And now you have to trust them too, it's not "your personal website" anymore.

Talking about trusting trust... your solution is more delegation to unknown entities.

Doesn't sound so convincing to me.

> No, HTTPS encrypts data according to the certificate authority

No, HTTPS works with self signed certs too, it's browsers that don't want you to and show a scary popup like this

https://help.univention.com/uploads/default/original/2X/5/5e...

Which is not even true, the connection is private, it is simply privately private and not "trusted" by any know CA.

which could not be a problem if I trust the website and who runs it.

But, again, the scary warning page will scare people away, while the connection is working as intended.

> I was kind of leaving privacy off the table

You are confusing privacy with secrecy.

HTTPS is not private, the connections being made are still visible.

> you don't understand what "panacea" means

I'm Italian with Greek roots, we literally invented the word.

Its original meaning is "plants that cure everything".

That's why my remarks.

It's still a plant name! (https://www.google.com/search?q=p%C3%A0nace)

> Rejecting basically free cryptography that substantially improves security

Yeah, I imagine you lock yourself in your house and set the alarm every time you exit from a room and then disable it every time you enter, after unlocking the door.

I'm sure you do it, it's free, it improves security!

> People being so concerned about centralization that they start sending messages in plain-text and start arguing with people online that sending messages in plain-text is somehow better for decentralization is at best misguided.

I know how you feel in your paranoia fueled World and I feel for you, but I tell you, dear friend, that you're wrong.

Nobody said what you're saying they did.

Use the easier solution available given the circumstances is simply sign of intellect.

You're not stupid, I'm sure of it, so why you acting like you were?

Yep, if you are Google you should put in place every layer of security you can think of and then double them.

But there's only a few Google around.

Besides, NSA can (and probably already is) collect encrypted streams and then try to break them offline.

Real time is not an hard requirement for them.

if what you are doing doesn't require secrecy, HTTP could suffice.

Imagine you built an app for weather reporting, the app downloads static json from a server using the hardcoded ip address.

HTTPS would add no benefit, worst that can happen is that someone hijacks the ip address (for some of the users, it's not possible to do it worldwide) and point the app to the wrong jsons, that might or might no be valid for the app.

Which is a lot of effort to break a weather app...