One of the Most Alarming Internet Proposals I've Seen
lauren.vortex.com
One of the Most Alarming Internet Proposals I've Seen
1–10 of 95 posts
Re: One of the Most Alarming Internet Proposals I've Seen
#2It actually appears that the RFC openly admits the potentials for abuse here:
"6. Security Considerations
This document addresses proxies that act as intermediary for HTTP2 traffic and therefore the security and privacy implications of having those proxies in the path need to be considered. MITM [4], [I-D.nottingham-http-proxy-problem] and [I-D.vidya-httpbis-explicit-proxy-ps] discuss various security and privacy issues associated with the use of proxies. Users should be made aware that, different than end-to-end HTTPS, the achievable security level is now also dependent on the security features/capabilities of the proxy as to what cipher suites it supports, which root CA certificates it trusts, how it checks certificate revocation status, etc.
Users should also be made aware that the proxy has visibility to the actual content they exchange with Web servers, including personal and sensitive information."
Re: One of the Most Alarming Internet Proposals I've Seen
#3Another stab at using 'Trusted proxies' huh? I thought we had learnt that lesson a while ago.. Can we move on please, internet?
Re: One of the Most Alarming Internet Proposals I've Seen
#4It actually appears that the RFC openly admits the potentials for abuse here: "6. Security Considerations This document addresses proxies that act as intermediary for HTTP2 traffic and therefore the security and privacy implications of having those proxies in the path need to be considered. MITM [4], [I-D.nottingham-http-proxy-problem] and [I-D.vidya-httpbis-explicit-proxy-ps] discuss various security and privacy iss…
To play devil's advocate, this could potentially be less harmful than the existing situation: where e.g. various corporate nets will require you to install root certs to accomplish the same MITM attack, in a less visible fashion (after installation), with some if not all of the same caveats - especially if given the ability to opt out.
(Bugs, insufficiently scary UI, and "discovery" are all massive concerns of course...)
Re: One of the Most Alarming Internet Proposals I've Seen
#5Crazy. If you want to use caching, just use HTTP for that content.
Re: One of the Most Alarming Internet Proposals I've Seen
#6There was another article on here a week or two ago effectively blasting the http/2.0 wg for doing stupid things. I think it was the "HTTP 308 incompetence expected" article.
Now this. I'm beginning to wonder if I want anything to do with HTTP/2.0.
Re: One of the Most Alarming Internet Proposals I've Seen
#7It actually appears that the RFC openly admits the potentials for abuse here: "6. Security Considerations This document addresses proxies that act as intermediary for HTTP2 traffic and therefore the security and privacy implications of having those proxies in the path need to be considered. MITM [4], [I-D.nottingham-http-proxy-problem] and [I-D.vidya-httpbis-explicit-proxy-ps] discuss various security and privacy iss…
Openly admitting the potential for abuse doesn't make this any less ridiculous of a proposal.
Re: One of the Most Alarming Internet Proposals I've Seen
#8Is someone from the NSA behind this?
Sorry, let me rephrase that. Who from the NSA is behind this?
Re: One of the Most Alarming Internet Proposals I've Seen
#9Crazy. If you want to use caching, just use HTTP for that content.
It's not that simple.
If you are going to use HTTPS, you need to use it for all content on that domain. Otherwise if you load for example a large javascript file over HTTP, the attacker can just poison that file and control your whole page.
Even if you loaded an image from the same domain, your credentials would sent sent as a cookie in plain text.
You could use a separate domain for content as explained here: http://stackoverflow.com/a/5160657/804713
Re: One of the Most Alarming Internet Proposals I've Seen
#10It actually appears that the RFC openly admits the potentials for abuse here: "6. Security Considerations This document addresses proxies that act as intermediary for HTTP2 traffic and therefore the security and privacy implications of having those proxies in the path need to be considered. MITM [4], [I-D.nottingham-http-proxy-problem] and [I-D.vidya-httpbis-explicit-proxy-ps] discuss various security and privacy iss…
Openly admitting the potential for abuse doesn't make this any less ridiculous of a proposal.
I'm not saying it does.