Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

There are 2.4 billion people on the Internet. We should get to know each other.

twopointfourbillion.com

Post reply on HN
Print view View original

21–27 of 27 posts

Re: There are 2.4 billion people on the Internet. We should get to know each other.

#21

Post by p4bl0 »

halviti wrote: post #16
p4bl0 wrote: post #11

Earlier quoted context omitted.

The certificate being "untrusted" doesn't mean anything about security. It just mean that they have signed it themselves and that no central authorities that you are supposed to trust for whatever reasons has signed it for them. All you want here is an encrypted communication, and you get that with the self-signed certificate as well.

Yes, you get encrypted communication all the way to the person intercepting your internet traffic, and they have an encrypted channel to the server they are relaying your traffic to. Security!

You are right, but it depends on your threat model, see my answer to eli.

Re: There are 2.4 billion people on the Internet. We should get to know each other.

#23

Post by jesalg »

Very cool. A similar idea had been buzzing around in my head for the last couple of months - you enter some attributes about yourself and on the other end get 1 match per week with whom you should connect with. Great way to meet new people. You guys beat me to it! Would love to see how this evolves.

EDIT:

After filling out the form, I think some things can be combined/simplified to make it easier to parse: - Many twitter users I follow tend to be the authors of the blogs I read as well. Maybe just connect with Twitter and get a listing of all the people I follow? - Also what format should the songs be listed in? or maybe just keep that limited to artists & bands. - Utilize Facebook Graph to pre-populate interests, music, movies.

Re: There are 2.4 billion people on the Internet. We should get to know each other.

#24

Post by caffeinewriter »

I'd love to have some way to add more interests after the fact, because I immediately realized I wanted to add one more thing after I hit submit. Maybe just even resubmit the form with the same email. Or enter your email and it'll bring up a profile. Something like that.

Re: There are 2.4 billion people on the Internet. We should get to know each other.

#25

Post by memoryfault »

p4bl0 wrote: post #21
halviti wrote: post #16

Earlier quoted context omitted.

Yes, you get encrypted communication all the way to the person intercepting your internet traffic, and they have an encrypted channel to the server they are relaying your traffic to. Security!

You are right, but it depends on your threat model, see my answer to eli.

Encrypted communication is not very useful if you aren't sure who you are communicating with. Using a self-signed cert greatly increases this uncertainty.

Re: There are 2.4 billion people on the Internet. We should get to know each other.

#26

Post by p4bl0 »

memoryfault wrote: post #25
p4bl0 wrote: post #21

Earlier quoted context omitted.

You are right, but it depends on your threat model, see my answer to eli.

Encrypted communication is not very useful if you aren't sure who you are communicating with. Using a self-signed cert greatly increases this uncertainty.

I would agree with you entirely if I had more reasons to transitively trust the root certificates authorities than to trust the people I believe are building the website, because in reality I don't know any of them. Certificate authority getting hacked and issuing trusted certificates to not trust worthy people have happened already. You may say that you still put more confidence in a certificate that is transitively trusted by those your browser and / or OS vendor chose for you, but why? The SSL certificate system as it is now is highly unsatisfactory to me. I would prefer something decentralized like the GPG trust network.

Re: There are 2.4 billion people on the Internet. We should get to know each other.

#27

Post by eli »

p4bl0 wrote: post #20
eli wrote: post #17

Earlier quoted context omitted.

No. Without a trusted authority or some other means to verify that the self-signed certificate is indeed coming from the site, there is effectively no security because it is trivial to launch a MITM attack.

For some definition of trivial. But you're right, it's not that simple (see below¹, I need to rant first). It's just that it upset me so much each time Firefox (or whatever browser, they all do it) load a webpage with a self-signed certificate and it acts like if I was attacked and my security is compromised or something… It's not worse than HTTP without SSL so why make me click two times like if I don't know what I'…

Sorry, but I think Firefox is doing exactly the right thing (by default) here. If you want it to do something else, I'd imagine there's a setting you can override somewhere.

In practice it is worse than no SSL because it provides a false sense of security to users who have been trained that HTTPS = secure.

Post reply on HN