21–30 of 63 posts
Earlier quoted context omitted.
I was referring specifically to the author's claim that deprecating HTTP and displaying a warning to users is the equivalent of "rendering large parts of the web inaccessible" and "massive book burning".
That's what I was referring to. I don't understand what you don't understand about the reference.
Earlier quoted context omitted.
Technically any CA can sign certificates from bad actors, letsencrypt is notable because they verify you own the domain automatically, and they do so for free.. I know of no issues in the ACME protocol. That said, any CA can sign anything and your browser will trust it in most* cases. * - Not under certificate pinning or CA pinning though.
Consider the scenario where I own a domain example.com for a year. Just a day before its expiry or just a day before I sell the domain to someone else, I obtain a certificate for it from letsencrypt via ACME protocol. A week or month from now, the new owner of the domain sets up a HTTPs website. With the old certificate I have, I can now launch an MITM attack on the new owner for about 2-3 months!
There really is no absolute right or wrong to this issue. HTTPS is indeed more secure for users, but it does have some cost, and I think OP has a sensible argument. If you really think HTTPS is the best thing ever and is absolutely better than HTTP in every sense, you're just looking at it superficially. When you start looking into how the entire Internet works and what role each party plays in the ecosystem, and how…
This, very much this. Plaintext doesn't require what is essentially authorisation from a central authority in order to communicate.
Let me tell you why this is very dishonest: 1. The internet was built without trust in mind because it was a simple connection between universities and government. There wasn't much need for security. Now that the internet exists, there is a great need for security. 2. Https is better than http. It's an evolution. It's not impossible to get a certificate. To verify who you are and to protect your users. 3. If you don…
Could you explain why browsers should flag sites like this? It's possible that I'm too naive to realize the issue, and I would appreciate some education on it.
EDIT: changed "blocked" to "flagged"
There really is no absolute right or wrong to this issue. HTTPS is indeed more secure for users, but it does have some cost, and I think OP has a sensible argument. If you really think HTTPS is the best thing ever and is absolutely better than HTTP in every sense, you're just looking at it superficially. When you start looking into how the entire Internet works and what role each party plays in the ecosystem, and how…
Saying HTTPS is centralized is like saying PGP is centralized. If it is, it's only because the underlying technologies (HTTP itself and DNS) are centralized, not an encryption and document-signing protocol layered on top of it.
Even if you can argue that HTTPS is a centralization force, it's almost certainly hyperbole to argue that it's the biggest centralization force on the web today. Surely network effects (Facebook, Amazon), huge amounts of capital, and control over a huge amount of information (Google) are far bigger factors?
Just weird and a bad blog post. The author also wrote this: http://scripting.com/2018/02/23.html The owner is a domain parker and is upset that he has to update hundreds of sites in order to be marked as insecure, is what I can gather In the last few weeks he's also wrote: - http://scripting.com/2018/02/21.html - http://this.how/googleAndHttp/ - http://scripting.com/2018/02/08.html
His arguments are also legitimately absurd. He says "if Google succeeds, it will make a lot of the web's history inaccessible", which is patently false given the fact you can always still access HTTP websites , not to mention that services like archive.org and Google's own cache exist. He then makes the argument that HTTPS will make it such that only "super nerds" will be able to create websites. But right now I can…
I'm really surprised that you think everyone has/should have(?) the same beliefs about such things.
He then argues that Google labeling HTTP as not secure is the first step down a path which leads to "blocking the pages outright", which is a prime example of the slippery slope fallacy.
20 years ago people thought buying computers on which you can't install software some central authority didn't approve of was preposterous, and yet here we are today with walled gardens and the like. This is a rise of authoritarianism, all in the name of "security". The frog boils slowly.
Earlier quoted context omitted.
A lot of the web properties are HTTP based and they probably won't bother to switch either because the owner doesn't care enough to go through all the hassle, or because they hosted their site/pages on a server whose owner doesn't care enough to go through all the hassle. Just because these owners don't care about their site, doesn't mean they are not valuable.
I was referring specifically to the author's claim that deprecating HTTP and displaying a warning to users is the equivalent of "rendering large parts of the web inaccessible" and "massive book burning".
A lot of content that exists on the unmaintained web is going to effectively be lost, and maybe that's okay because the benefits are worth it, but that's the argument that needs to be made.
Earlier quoted context omitted.
That's what I was referring to. I don't understand what you don't understand about the reference.
Displaying a warning to users doesn't make sites "inaccessible".
Let me tell you why this is very dishonest: 1. The internet was built without trust in mind because it was a simple connection between universities and government. There wasn't much need for security. Now that the internet exists, there is a great need for security. 2. Https is better than http. It's an evolution. It's not impossible to get a certificate. To verify who you are and to protect your users. 3. If you don…
None of these statements convince me that http sites should be default flagged as insecure. Take this site, for instance: http://wilsonminesco.com/6502primer/65tutor_intro.html . It is a great resource, but is not available over https. yeah, it's possible that someone could MITM it to provide me with incorrect info on the 6502, but I don't see the disregard for my privacy. I'm never going to put in any of my own info…