211–220 of 222 posts
Earlier quoted context omitted.
> What downsides POP3 has? Looks like a terribly simple protocol Exactly that, it's terribly simple. People have multiple devices, that alone makes POP3 an annoying protocol to use.
>> ... multiple devices, that alone... A big assumption. POP3 works perfectly fine and is preferable in my situation.
Earlier quoted context omitted.
My ISP injects ads into http sites often. Now just imagine what this corrupt third world government here can do. Of course its "not a problem" if you aren't a vulnerable person who dares go against the grain, but on the whole it is. If your site is not using tls then it's automatically blocked sorry, maybe I'm not your target audience regarding security blogs though :)
I think the more important question is why are you still supporting this ISP by being their customer?
Earlier quoted context omitted.
The Gemini protocol is not a commercially-controlled HTTPS. Some folks like it better than HTTPS. 4.2 Server certificate validation Clients can validate TLS connections however they like (including not at all) but the strongly RECOMMENDED approach is to implement a lightweight "TOFU" certificate-pinning system which treats self-signed certificates as first- class citizens. This greatly reduces TLS overhead on the net…
Some people might like it more, but it's a terrible model. Most ISP's can't be trusted, TOFU becomes basically useless. Ignoring that major issue with the model, it's also unusable in especially untrustworthy networks like Airport WiFi. I'm also going to preemptively say that suggesting not to visit new websites on those networks (because you can't TOFU) is just ridiculous. "It is not awful" in this context is a very…
Why not just use HTTPS on the "untrustworthy" ISP's.
The use of the word "most" implies that there are some that can be trusted.
Assuming you are a trustorthy source for such information (and how do I know it's really you and not an "imposter"), then what are they. Please list the ISPs everyone can "trust".
The point that is being missed in this comment thread, and most others about TLS, HTTPS and CAs, is that there is a question of who decides whether something is "trustworthy" or not.
Personally I like to make these decisions for myself. Unlike an incredible number of internet commentators, I do not purport to tell anyone else who they should or should not trust. That decision is ultimately for each person to make on their own. We can provide information that may help a person with their decision, but it's still their decision, not mine.
But that's not how "chain of trust" works.
The concept of "chain of trust" itself does not even exist in the real world. It only exists in the imagination of socially inept persons hiding behind keyboards. In practice, for HTTPS, the cast of characters is a laundry list of third party intermediaries, all trying "cash in" on the use of the internet, a public resource we already pay ISP's to access. The idea that any of them would be sources of "trust" is comical.
Why trust "domain name registrars" as a source of useful information about people who run websites.
Why trust CAs issuing non-EV certificates. They only verify that someone rents a domain name from an "ICANN-approved" registry.
Why trust CAs issuing EV certificates. The people approving these CAs all have a vested interest in the web (browser) as a means of online advertising.
Why trust the people who "approve" CAs for inclusion in popular web browsers.
There are something like 75 CAs hardcoded into popular web browsers. If I want to remove one, what do I have to edit the source code and recompile. Inconvenient to say the least.
In all of this third party nonsense, there is no opportunity for an ordinary person, not invested in or benefitting from the "tech" company racket, to have any input on whether or not she wants to "trust" a website is being operated by a particular person. She is effectively locked out of the process. These third parties are often comprised of people I would never trust IRL. But they hide behind keyboards so we never get to see them for what they are.
At least with Gemini, clients and servers are smaller and simpler, and easy to edit and recompile. Gemini clients, written by anyone, not necesarily "tech" companies, are not designed with online advertising in mind. The protocol itself is not "advertising-friendly". It is little more than plain text.
The "threat model" for me in the majority of web use is the "business model" of so-called "tech" companies, i.e., surveillance, data collection and advertising, not "imposters". Nevermind that "tech" companies have pushed for a web that is 100% commercial/political, where even recreational use is monitored for insights useful to advertising. That only creates a greater incentive for "imposters". When I started using the internet it was still predominantly used for academic and military purposes.
If a "tech" company employee wants to choose to use HTTPS, DNSSEC, TOFU, etc., then that is their decision. But if they want to remove the ability of anyone else to make that decision for themselves, then I see a problem with that.
Earlier quoted context omitted.
Some people might like it more, but it's a terrible model. Most ISP's can't be trusted, TOFU becomes basically useless. Ignoring that major issue with the model, it's also unusable in especially untrustworthy networks like Airport WiFi. I'm also going to preemptively say that suggesting not to visit new websites on those networks (because you can't TOFU) is just ridiculous. "It is not awful" in this context is a very…
"Most ISP's can't be trusted, TOFU becomes essentially useless." Why not just use HTTPS on the "untrustworthy" ISP's. The use of the word "most" implies that there are some that can be trusted. Assuming you are a trustorthy source for such information (and how do I know it's really you and not an "imposter"), then what are they. Please list the ISPs everyone can "trust". The point that is being missed in this comment…
I don't know, ask the Gemini people.
> The use of the word "most" implies that there are some that can be trusted.
Only a Sith deals in absolutes. I'm sure someone out there is their own ISP and can trust themselves.
> Personally I like to make these decisions for myself.
Sure, you do you. That doesn't make it a widely viable neither mostly secure approach.
Earlier quoted context omitted.
"Most ISP's can't be trusted, TOFU becomes essentially useless." Why not just use HTTPS on the "untrustworthy" ISP's. The use of the word "most" implies that there are some that can be trusted. Assuming you are a trustorthy source for such information (and how do I know it's really you and not an "imposter"), then what are they. Please list the ISPs everyone can "trust". The point that is being missed in this comment…
> Why not just use HTTPS on the "untrustworthy" ISP's. I don't know, ask the Gemini people. > The use of the word "most" implies that there are some that can be trusted. Only a Sith deals in absolutes. I'm sure someone out there is their own ISP and can trust themselves. > Personally I like to make these decisions for myself. Sure, you do you. That doesn't make it a widely viable neither mostly secure approach.
Earlier quoted context omitted.
> That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. And one big advantage - it actually allows you retrieve and store e-mail locally - irrespective of any server allocation.
Um what? Nothing in IMAP prevents you from doing the same. Just because most client implementations assume you want to keep your mail on the server by default, does not mean the protocol doesn’t account for the other possibility. And to be fair, configuring most clients to retrieve and then delete, or keep a local copy in addition to the server one, is not difficult at all - these options are not hidden or anything.
Earlier quoted context omitted.
Yeah, but typically the difference is that you can't see IMAP as a backup. Whereas with POP3 (and not having your client set up to automatically delete emails on the server) you can. With IMAP, when an email gets deleted by some client, other clients will also delete their local copies of that email. That won't happen with POP3. But I haven't read either of the two protocols, so I'm not sure whether that's something…
Yeah, it's much better with POP3, when one client downloads everything it deletes it from the server /s This isn't IMAP limitation, this is how clients implemented it. Nothing stops one to download every message over IMAP and never delete them.
Earlier quoted context omitted.
Um what? Nothing in IMAP prevents you from doing the same. Just because most client implementations assume you want to keep your mail on the server by default, does not mean the protocol doesn’t account for the other possibility. And to be fair, configuring most clients to retrieve and then delete, or keep a local copy in addition to the server one, is not difficult at all - these options are not hidden or anything.
I would challenge you to show how you would configure a common IMAP client to keep email locally and delete it from the server.
Earlier quoted context omitted.
> Lack of HTTPS on the author's site also adds a nice subtle flavour to the blogpost. If you're not doing anything requiring security, you don't need HTTPS, IMHO. > POP should really be considered legacy I know people who knowingly use POP to keep their remote boxes empty, and keep everything local, so I don't think we should decide for people that swiftly. Similarly, I'll let the wisdom of "Teh Internetz" to decide…
> If you're not doing anything requiring security, you don't need HTTPS, IMHO. I disagree, for a lot of reasons. For one thing, I don't want some random WI-FI to know every page I visit, even insecure pages. I also don't want to leak any information about my browsing habits. Using https everywhere limits the information you leak about how much of your traffic is sensitive.
You're leaking data all over the place, placing the burden on the website owner is silly.
Earlier quoted context omitted.
I think the more important question is why are you still supporting this ISP by being their customer?
could be on airport wifi, store wifi, cafe wifi, hotel wifi, etc... https prevents them injecting shit
Even with https, there's no scenario where I'm not encapsulating all traffic in a tunnel there.