We often hear the complaint here that nobody cares / cared about Snowden's revelations. But to me it seems he did provide a lot of the impetus for having HTTPS virtually everywhere and a lot of the instant messenging apps being end-to-end encrypted. Most of WhatsApp's users are as non-technical as it gets, and yet they use the kind of encryption that only computer enthusiasts were interested in just a couple years ag…
Encrypted web traffic now exceeds 90%
181–190 of 311 posts
Re: Encrypted web traffic now exceeds 90%
#182Earlier quoted context omitted.
Pretty much this. I ran into a local store taking credit cards awhile back, no TLS, weird, so I go to the store owner in person. I explain the problem and he insists that can't be the case, he's mad at me. "See! It's got a lock on the website!"... on the homepage. I direct him to the store and now it says Not Secure. That did more to explain the situation than my attempt at TLS and HTTPS and Certs. He was able to cal…
If that doesn't work, there's also the argument that "credit card providers require it, and could stop you from taking credit cards until you fix it".
Re: Encrypted web traffic now exceeds 90%
#183We often hear the complaint here that nobody cares / cared about Snowden's revelations. But to me it seems he did provide a lot of the impetus for having HTTPS virtually everywhere and a lot of the instant messenging apps being end-to-end encrypted. Most of WhatsApp's users are as non-technical as it gets, and yet they use the kind of encryption that only computer enthusiasts were interested in just a couple years ag…
The public backlash to these revelations is what seems lacking. It had very small political effects, and seemingly very little effect on the NSA. They did not change their stance much, and their weren't really consequences for what the NSA was doing.
Re: Encrypted web traffic now exceeds 90%
#184Earlier quoted context omitted.
Ironically, Telegram markets itself as the most private and secure messenger, but in reality, it's much less private than WhatsApp or Viber: any regular (non-secret) Telegram chats are not end-to-end encrypted - if they were, you wouldn't be able to access them from a new device after authorization with a password.
They don’t claim end to end encryption by default though. You make it sound as if there is a revelation you made here. Telegram has faults, I would even argue it has many, but it’s clear that only “secret” chats and voice/video calls are end to end encrypted. Whatsapp, however, does allow you to download all of your messages from your device using WhatsApp web, and they were recently shown to have an exploit/backdoor…
They don't claim e2e encryption by default, they just use some very tricky words that non-technical users will assume as encryption.
From telegram.org:
"Private: Telegram messages are heavily encrypted and can self-destruct."
"Secure: Telegram keeps your messages safe from hacker attacks."
"Encrypt personal and business secrets."
Re: Encrypted web traffic now exceeds 90%
#185We often hear the complaint here that nobody cares / cared about Snowden's revelations. But to me it seems he did provide a lot of the impetus for having HTTPS virtually everywhere and a lot of the instant messenging apps being end-to-end encrypted. Most of WhatsApp's users are as non-technical as it gets, and yet they use the kind of encryption that only computer enthusiasts were interested in just a couple years ag…
Agree Snowden is significant because he was able to encourage enough people to INSIST on strong privacy/encryption. Then it all comes down to basic game theory. Why would a company ever want to release any product without strong encryption (end-to-end) when users never complain about their data being encrypted. The only reason companies don't encrypt is when they have a vested interest in spying, either in their own…
Re: Encrypted web traffic now exceeds 90%
#186Earlier quoted context omitted.
Several reasons: - The good is not the enemy of the perfect. - This eliminates an entire class of attacks, namely, man-in-the-middle. - A lot of (most?) user interactions require the server to know what the user wants, and it's unclear how this can happen if the server can't view the user's data.
MITM is not mitigated at all by HTTPS. What makes you think that? Do you understand how certificate signing works?
Establishing a shared secret with another party over a public channel is not that hard (Diffie-helman, RSA). The hard part is to ensure the other party is who they say they are. Certificates tackle this by having a trusted party (CA) cryptographically bind the shared secret to an identity.
There are issues here, but if you can read and modify the traffic between my PC and the HN servers, you still won't be able to read and modify the traffic.
Re: Encrypted web traffic now exceeds 90%
#187Earlier quoted context omitted.
You're not wrong, but the realistic alternative is having it the same way, just without any encryption.
Yes but in this case caching proxies and other distributed approaches still would work out of the box as alternatives to cdns. I am not sure what I have gained. Nobody cares about end to end email encryption. This would be a real benefit, but Google could not build profiles so easily...
AFAIK google states (in their privacy policy) they do not do anything with the contents of your emails in a gmail account.
Re: Encrypted web traffic now exceeds 90%
#188Earlier quoted context omitted.
19 days before Snowden flew to Hong Kong, former FBI counter-terrorism agent Tim Clemente spilled the beans on CNN[0] (for context, informarion from a phonecall between one of the Boston Marathon bombers and his wife had been leaked to the media): >BURNETT: Tim, is there any way, obviously, there is a voice mail they can try to get the phone companies to give that up at this point. It's not a voice mail. It's just a…
Snowden released a large collection of documents. Judging by his interview with Joe Rogan, he's a passionate advocate for encryption and says that the US is creating a tool for complete oppression. It's harder to get more apocalyptic than that.
I'm not making any conspiratorial claims about this part, but as an aside it was weird to me that he claimed cellphone IMEIs can't be changed. It's not normally done, but it can be. I wasn't sure if that was dumbed down for Rogan's audience, a misspeak, or actual ignorance on Snowden's part.
Re: Encrypted web traffic now exceeds 90%
#189Earlier quoted context omitted.
...do you? Unless the attacker has access to the private key associated with the SSL certificate, they can't read any HTTPS traffic encrypted via that certificate - mitigating the ability of that bad actor to perform a MITM attack.
And even if they get a key, they will show up in the CT Logs eventually and the attack becomes public.
Re: Encrypted web traffic now exceeds 90%
#190Earlier quoted context omitted.
The above poster is still technically correct though, getting the cert is just 1 more obstacle in the way of the attack, which isn't as much of an obstacle as one would think for some actors(see China).
Certificate transparency would make it blatantly obvious if Chinese CAs were issuing bogus certificates. (And if they issued certs without submitting them to CT logs they wouldn't be accepted by Chrome or Safari, so it wouldn't be very useful.) Sure, they could do it, but it wouldn't be long until there were no Chinese CAs trusted by any browser.