Let me tell you why this is very dishonest:
1. The internet was built without trust in mind because it was a simple connection between universities and government. There wasn't much need for security. Now that the internet exists, there is a great need for security.
2. Https is better than http. It's an evolution. It's not impossible to get a certificate. To verify who you are and to protect your users.
3. If you don't care about your users' privacy, perhaps you shouldn't be hosting sites. To be completely honest, Google is a bit slow with this. I know the difficulty it posses, but it's worth it.
We need to stop passing unencrypted data. We need the internet to finally care about security and privacy.
The internet has evolved, ipv4 has been used up (in terms of devices). It's time.
Google and HTTP
11–20 of 63 posts
Re: Google and HTTP
#12Whats the deal with letsencrypt? If anyone can get a certificate for the domains I own, it can't stop man in the middle attacks. How is this any better than a self signed cert which throws a hissy fit when you visit? Thats a browser issue to me not an inherant technical advantage. Anyone can get a cert from it including criminals. Google sometimes makes the news when they revoke a cert authority because of criminal a…
Lets Encrypt only verifies that the entity requesting the cert basically has control of the domain.
I would agree that the biggest issue with TLS is the certificate authorities. All the trust lies in them. If they issue a bad certificate for google, microsoft, usbank ect... It can cause problems. This is part of the reason HTTP key pinning exists. Further, CAs have issued bad certs. It's happened and will happen again.
However, there are a lot websites that in theory do not need TLS. However, the browsers are preventing HTTP only sites from using newer features. For instance HTTP 2.0 does not require TLS, but none of the browsers support plain text HTTP 2.0. (So the browsers are ignoring the standard)
So why do the browsers push so hard for TLS. As this article mentions MITM. Considering how complicated the web standards for CSS, JS, and HTML are these days. There is a potential attack vector. So in theory an attacker could insert content on the page your viewing that uses a zero day exploit. However, I think people are forgetting it's probably easier to get people to just visit a website with the exploit via some click baity title.
The next reason is that it prevents people from snooping on other people. However, a website that displays the time for instance is not really that big of issue. However, there is content people view that they would not like someone else knowing. Although, the DNS system can give that away if the website is topical in nature. However, I would not call this insecure as the browsers do. Really it should be noted that the content your viewing may be observed. However, that is not a security issue unless the site is serving private information. At that point the server operator is screwing up.
Really, if the user can't verify (does not know how) and does not verify the certificate it's not secure. It's more likely to be secure. Even if the user verifies the certificate if the server or user's computer is compromised the encryption is good as non-existent. If your worried about the user loading any scripts with any possible exploits Java-script probably should be removed the web standards. As I mentioned it's not hard to get users to view a site with some payload taking advantage of an exploit.
Part of the problem is that we have everyday people using the web more and more these days. They don't know necessarily know when they should be worried about security. However, what is annoying me more for instance with HTTP 2.0. I can't go into Firefox's about:config and enable plain text HTTP 2.0. I can agree with sane defaults, but really I should be able to change those.
Re: Google and HTTP
#13> Also, if Google succeeds, it will make a lot of the web's history inaccessible.
> It's like a massive book burning, at a much bigger scale than ever done before.
How on earth did the author reach these conclusions?
Re: Google and HTTP
#14Just weird and a bad blog post. The author also wrote this:
http://scripting.com/2018/02/23.html
The owner is a domain parker and is upset that he has to update hundreds of sites in order to be marked as insecure, is what I can gather
In the last few weeks he's also wrote:
- http://scripting.com/2018/02/21.html
Re: Google and HTTP
#15> Also, if Google succeeds, it will make a lot of the web's history inaccessible. > It's like a massive book burning, at a much bigger scale than ever done before. How on earth did the author reach these conclusions?
A lot of the web properties are HTTP based and they probably won't bother to switch either because the owner doesn't care enough to go through all the hassle, or because they hosted their site/pages on a server whose owner doesn't care enough to go through all the hassle.
Just because these owners don't care about their site, doesn't mean they are not valuable.
Re: Google and HTTP
#16Just weird and a bad blog post. The author also wrote this: http://scripting.com/2018/02/23.html The owner is a domain parker and is upset that he has to update hundreds of sites in order to be marked as insecure, is what I can gather In the last few weeks he's also wrote: - http://scripting.com/2018/02/21.html - http://this.how/googleAndHttp/ - http://scripting.com/2018/02/08.html
The owner is the guy who invented RSS. I think he knows a thing or two about what he's talking about.
If you think it's weird and very bad, explain why you think so. I for one can sympathize with his point of view.
Re: Google and HTTP
#17> Also, if Google succeeds, it will make a lot of the web's history inaccessible. > It's like a massive book burning, at a much bigger scale than ever done before. How on earth did the author reach these conclusions?
A lot of the web properties are HTTP based and they probably won't bother to switch either because the owner doesn't care enough to go through all the hassle, or because they hosted their site/pages on a server whose owner doesn't care enough to go through all the hassle. Just because these owners don't care about their site, doesn't mean they are not valuable.
I was referring specifically to the author's claim that deprecating HTTP and displaying a warning to users is the equivalent of "rendering large parts of the web inaccessible" and "massive book burning".
Re: Google and HTTP
#18There really is no absolute right or wrong to this issue.
HTTPS is indeed more secure for users, but it does have some cost, and I think OP has a sensible argument.
If you really think HTTPS is the best thing ever and is absolutely better than HTTP in every sense, you're just looking at it superficially.
When you start looking into how the entire Internet works and what role each party plays in the ecosystem, and how much "real" power each party has, you'll find that HTTPS is THE biggest centralization force of the web. If you think centralization and oligopoly by big tech companies is awesome, fine.
But there are people who don't like that direction for a good reason.
Re: Google and HTTP
#19Earlier quoted context omitted.
A lot of the web properties are HTTP based and they probably won't bother to switch either because the owner doesn't care enough to go through all the hassle, or because they hosted their site/pages on a server whose owner doesn't care enough to go through all the hassle. Just because these owners don't care about their site, doesn't mean they are not valuable.
I was referring specifically to the author's claim that deprecating HTTP and displaying a warning to users is the equivalent of "rendering large parts of the web inaccessible" and "massive book burning".
That's what I was referring to. I don't understand what you don't understand about the reference.
Re: Google and HTTP
#20Just weird and a bad blog post. The author also wrote this: http://scripting.com/2018/02/23.html The owner is a domain parker and is upset that he has to update hundreds of sites in order to be marked as insecure, is what I can gather In the last few weeks he's also wrote: - http://scripting.com/2018/02/21.html - http://this.how/googleAndHttp/ - http://scripting.com/2018/02/08.html
His arguments are also legitimately absurd. He says "if Google succeeds, it will make a lot of the web's history inaccessible", which is patently false given the fact you can always still access HTTP websites, not to mention that services like archive.org and Google's own cache exist.
He then makes the argument that HTTPS will make it such that only "super nerds" will be able to create websites. But right now I can host my own blog on services like Netlify and get an HTTPS certificate for multiple domains with one click. If I want my own server it literally takes two seconds for me to set up certbot and get certificates for free. Then he makes a odd and somewhat rambling comparison to the Grand Canyon.
He then argues that Google labeling HTTP as not secure is the first step down a path which leads to "blocking the pages outright", which is a prime example of the slippery slope fallacy.
In another blog post he argues that by applying Occam's razor, it's clear that Google just wants to protect their ad revenue (because HTTPS would allow ISPs to replace Google's ads with their own). Which honestly sounds insane.
I'm really surprised that this person is a software developer. I'm even more surprised that he still believes this stuff after working for 24 years.