101–110 of 113 posts
Earlier quoted context omitted.
That's simple, they just won't, browsers will only support HTTP/2 over TLS, so proxies are effectively dead.
Every large web site uses a load balancer, effectively a proxy. I don't understand why Poul Henning-Kamp's experience with that didn't carry more weight in the working group.
"Expires: January 31, 2015" - What does it mean?
Anyone have a link to a overview type blog post of the changes? This is a tad foreign for a guy like me who has little experience of this layer of the OSI model.
Earlier quoted context omitted.
> Devil's Advocate: there is no world wide cabal of wifi hackers trying to steal the Facebook login cookies of starbucks customers. The lack of security is real, but the dangers are overblown. Perhaps not, but consider for example that the Starbucks near people with valuable IP (e.g., many Starbucks in Silicon Valley, in NYC, in Washington DC, in Redmond WA, in Cambridge MA, in Beverly Hills, in the Hamptons, etc.) w…
A valuable target will always get hacked because they'll be specifically targeted. For most of them it'll be from spearphishing, but there's a multitude of ways to attack people even if https is the default. All well known celebrity hacks are done either by spearphishing or breaking into an account independent of contact with the person. And in general it's probably not a good idea to set world-wide standards on the…
Yes there are other vulnerabilities, but that's not a reason to fail protect against this one (taking that reasoning to an extreme, all security is pointless because there always are other vulnerabilities). The purpose of security is to increase the cost of a successful attack; https has a high ROI in many cases. In the example you give, spear-phishing is much more expensive than sniffing wifi.
Anyone have a link to a overview type blog post of the changes? This is a tad foreign for a guy like me who has little experience of this layer of the OSI model.
http://queue.acm.org/detail.cfm?id=2555617 https://www.mnot.net/blog/2014/01/30/http2_expectations https://www.mnot.net/talks/http2-wtf/#/
Earlier quoted context omitted.
Every large web site uses a load balancer, effectively a proxy. I don't understand why Poul Henning-Kamp's experience with that didn't carry more weight in the working group.
In HTTP terms a reverse proxy is just a Web server (what it does internally is its own business), not a proxy. HTTP/2 load balancers have no trouble terminating TLS.
Earlier quoted context omitted.
I'm impressed I'm somehow getting modded down for that opinion. My local network is trusted. Google does not have a local network. But the cables and wires physically within my house or even my office building can be presumed to be secure, since if you can get access to those, then you could also just take the physical machines by any numbers of methods. You also don't address "large but insensitive data" - which is…
Considering that your local network is trusted defies "defense in depth" - do you use Telnet for your admin? What happens with your Wifi, or if one of your computers gets pwned and starts becoming a packet-sniffing machine? Google feel it's potentially sensitive data. After all, it's showing what you're reading, what you're downloading, what you're seeing. Laptops/desktops are way too big to feel any noticeable effec…
Always on encryption is pointless and the type of always on encryption with HTTP 2 people talk about is worse then pointless. The idea that MitM is difficult is a farce - any number of WPS hijacking techniques involve forcing the host offline temporarily so it has to re-authenticate. The same thing would apply here. Taking what, 2 seconds?
You talk about defense in depth - one aspect of that is that a leaking side-channel has finite bandwidth and can't possibly hope to capture "all the data" which means it has to try and capture important data.
Earlier quoted context omitted.
Why does it have to be video? Some of the simplest sites around are plain text or text and images. Why do I need SSL or TLS to view either of these? I am very aware that anything authenticated should be carried over an encrypted connection - I'm not arguing against that. I'm saying there are use-cases that do not require it.
Because otherwise nation-state adversaries can see everything you read. IETF position on this is pretty clear after the technical plenary last year.
You know what might actually make some fucking sense. Enforce SSL/TLS where it is needed - disable HTTP Auth, Cookies, Location Services, Local Storage, etc over plain HTTP connections.
Earlier quoted context omitted.
Do you want your location along with your credentials to your lol cats forum in the wild ? Depending on what site you're going to, you can be screwed pretty easily.
I didn't mention credentials. Plenty of web use is anonymous, and has 0 need for SSL/TLS