It’s Time to Encrypt the Entire Internet
1–10 of 99 posts
Re: It’s Time to Encrypt the Entire Internet
#2Yet when I go to this link it's plain HTTP.
Re: It’s Time to Encrypt the Entire Internet
#3Yet when I go to this link it's plain HTTP.
It's actually worse than plain HTTP, requesting HTTPS redirects you to the plain HTTP version.
Re: It’s Time to Encrypt the Entire Internet
#4Encrypting the internet is not enough if a few companies have unlimited resources and the freedom to figure out how to break the encryption (legally).
*Edited for clarity
Re: It’s Time to Encrypt the Entire Internet
#5So perhaps this should start with a reduction in the cost of valid, "don't throw a security warning" certificates down to zero.
At the moment the SSL certificate industry is one big ripoff fest...
Re: It’s Time to Encrypt the Entire Internet
#6Encrypting the internet is not enough if a few companies have unlimited resources and the freedom to figure out how to break the encryption (legally). *Edited for clarity
False. What you say reduces the usefulness of encrypting everything but certainly doesn't make it "useless".
Re: It’s Time to Encrypt the Entire Internet
#7Encrypting the internet is not enough if a few companies have unlimited resources and the freedom to figure out how to break the encryption (legally). *Edited for clarity
False. What you say reduces the usefulness of encrypting everything but certainly doesn't make it "useless".
That's true, I misspoke. It does make it hard for the average joe hacker to get steal information, which is very valuable.
Re: It’s Time to Encrypt the Entire Internet
#8The only problem I see with https everywhere is the current CA system. I don't trust CAs, and I don't want to pay them. If we can get rid of them somehow there is nothing in the way of https everywhere anymore. I really like the http://convergence.io/ approach, but anything else that gets rid of a central authority I have to trust will do for me.
Re: It’s Time to Encrypt the Entire Internet
#9Yet when I go to this link it's plain HTTP.
Wired just got it wrong postfixing https instead of prefix :) http://www.wired.com/2014/04/https/
But to stay on topic: encouraging this kind of major shift to SSL spreads a problem that is still there but is very little acknowledged or worked on -- revocations.
Certificate revocation check is using either CRL or OCSP. CRL is a list of all the revoked certificates - browser needs to download the whole file and then check if the cert is revoked. OCSP is an optimized protocol to perform a more efficient certificate validation.
CRL is slowly being phased out as it grows too fast and there are jokes around that thanks to heartbleed the size becomes comparable to a blockchain.
But now the real issue: almost NONE of the mobile browsers check for revocation! Add to this that by default Chrome is not checking for cert revocation either. So isn't this rendering the whole revocation mechanism almost useless against a real attack?
There is a reason why it's not done in mobile (and Chrome) -- it makes the requests slower, especially in mobile. There is a timeout fallback in browser so that whenever OCSP responder times out then browser assumes the cert is valid. Which is not helping when the real attack is executed.
To sum up, until there is a 99% browser-market covering revocation mechanism that is not slowing down the browser CA-based SSL certificates are too fragile to get us to the safe and encrypted future.
Re: It’s Time to Encrypt the Entire Internet
#10It's time to decentralize the internet. There is no good reason why we can't have email, webpages, photos, even facebook-like social stuff housed on our own machines in our own homes (or some other place under our control).
The current situation is akin to having to travel to some centralized letter-reading facility in order to read letter mail. Your grandma sends you a letter in the mail and you have to go to a central facility downtown, then prove your identity, and then they hand over the (opened) letter.
We put a man on the moon more than 40 years ago. We must be able to sort this out.