21–30 of 37 posts
Vaccine analogy answer from stackexchange: It's not just about you, it's about herd immunity. Having everyone have secure communications helps makes others secure as well.
I suppose it's nice to have the rationale written out somewhere, but does anyone anywhere actually balk at being required to use HTTPS?
I suppose it's nice to have the rationale written out somewhere, but does anyone anywhere actually balk at being required to use HTTPS?
Plausible deniability is frequently more useful then encryption. The probability of someone messing with my packets in-flight is low. But TLS creates the problem that you are possibly then able to prove that the packets I sent came from me.
I suppose it's nice to have the rationale written out somewhere, but does anyone anywhere actually balk at being required to use HTTPS?
First, I've been enough places where Internet connectivity is so poor that HTTPS effectively breaks the connection. I used to stay half the week somewhere where the only connectivity was a dire, over-saturated 3G link. I couldn't browse HTTPS sites unless I was very lucky.
Second, I'm uneasy with the implication that "HTTPS=secure", in that it absolves the user of taking any responsibility for their own security. A site can require a HTTPS connection and still store the password in cleartext, for example; so unless you have a unique password, this "secure" site can still screw you. Yeah, I know HN readers understand the difference, but IMX most people dimly understand a binary distinction between "secure site" and "not secure site" and that's it.
Third and related, the corollary of "HTTPS=secure" is that "sites that only use HTTP = insecure". This is leading to a requirement that any guy who builds a website with login functionality needs to implement HTTPS, and that saddens me. The web becomes less democratic, less meritocratic, the more technical hurdles we require.
But, like I say, I realise 99.9% of people disagree with me.
I agree with the overall point of the responses that Google isn't in fact evil to be doing this, but I want to disagree somewhat with one point - the idea that Google doesn't have any obligation to respect users wishes just because its a free service that no one is forcing you to use. The problem with this is that Google's very existence makes it harder for similar services to exist. There are a few reasons for this,…
1. Google fought then-giants such as AltaVista, Excite and Yahoo in the process of establishing itself as the leader in search space. The incumbents had economies of scale and (relatively) massive amounts of data to crunch through. Yet a Google happened!
2. ``Google's very existence makes it harder for similar services to exist." History has proved time and again that such a premise is false. When it does become false, it is usually because of `dissimilar' disruptions in the landscape.
A comment on the answer perfectly encapsulates this post: Did you just troll security.SE and then reasonably answer your own question? – Stephen Touset
I agree with the overall point of the responses that Google isn't in fact evil to be doing this, but I want to disagree somewhat with one point - the idea that Google doesn't have any obligation to respect users wishes just because its a free service that no one is forcing you to use. The problem with this is that Google's very existence makes it harder for similar services to exist. There are a few reasons for this,…
Two points. 1. Google fought then-giants such as AltaVista, Excite and Yahoo in the process of establishing itself as the leader in search space. The incumbents had economies of scale and (relatively) massive amounts of data to crunch through. Yet a Google happened! 2. ``Google's very existence makes it harder for similar services to exist." History has proved time and again that such a premise is false. When it does…
2. You are contradicting yourself. "When it does become false" implies that it is true at some point, i.e., that there are hurdles to overcome, that is to say, that it is harder for a similar service to exist. Noone says that it is impossible, just that it is harder, and the form that that usually takes is precisely that it takes what you call "dissimilar disruptions" to establish an alternative. Having to come up with a "dissimilar disruptions" obviously is harder that coming up with some small evolutionary improvement.
I agree with the overall point of the responses that Google isn't in fact evil to be doing this, but I want to disagree somewhat with one point - the idea that Google doesn't have any obligation to respect users wishes just because its a free service that no one is forcing you to use. The problem with this is that Google's very existence makes it harder for similar services to exist. There are a few reasons for this,…
So yes, Google gets a temporary lock on mindset and technology, but as technology progresses there open up new opportunities to unseat the incumbents. If you'd asked anyone 10 or 20 years ago whether Microsoft could be unseated, they would have said you were crazy. The same goes for Google. With technology, nothing is permanent. Either you innovate, or you get left behind.
Can anyone explain this line from commenter Darren Cook: "Once this enforcement is in place, browsers will simply refuse to connect to Google over an insecure or compromised connection. By shipping this setting in the browser itself, circumvention will become effectively impossible." Some browsers are open source, and it seems to me that developers can never definitely rely on their behavior. Surely the enforcement d…