211–220 of 318 posts
Earlier quoted context omitted.
I do not, and I do not like them either. They are a liberal lobby.
Which specific EFF policies/goals are you opposed to?
Can someone explain why HTTPS is necessary for a webpage where I don't log in or submit any information? For example, take the xkcd homepage. Not only do I not log into it, there's nowhere I _could_ log in. The only input is a search box (which seems to be disabled at the moment anyway). Is it really a security risk if my communication with xkcd's servers is unencrypted? (Yes, xkcd has a store and a forum, and I unde…
https://citizenlab.org/2014/08/cat-video-and-the-death-of-cl...
Earlier quoted context omitted.
Can someone explain why we can't give SSL certificates along with domain registration? We already trust the DNS, don't we?
No. Consider that DNS request/responses are simple, cleartext UDP packets. There's DNSSEC of course but nobody uses it (and also most security experts don't like it).
You could compare it to IPsec, which is what most VPNs use, which is comparable in security and design. They both, together with SSL, suffer from a bad case of design-by-committee, including atrocities like X509.
DNSSEC did get an important thing right. You are in full control of your own keys, and your DNS provider can not impersonate you. Having an external DNS hosting provider was not common back then, but it is now, and I'm glad they got that right.
I envy you, citizens of the free world :) You (mostly) can use HTTPS, avoid government surveillance, and use new shiny Mozilla features (for whatever they are going to be). It's not the same in e.g. Russia (and I'm sure it's not just Russia). In Russia, the Web is now officially being censored by the state. They have a national register of prohibited resources -- basically, a huge list of URLs. Every ISP must block a…
So, apparently does not matter how many web-services would be secured by HTTPS, there's no problem to spy, and there's always the way to make owners (even if it's Google) let governments use their data - does not matter whether it's encrypted or not. Moreover, in Russia this list is available for everyone, but PRISM has been revealed to public only by Snowden.
This is stupid. There are all kinds of use cases where you don't care who knows what you're looking at, or whether it is authentic. Say I navigate to some restaurant's web page using HTTP. Even if I used HTTPS, someone spying on my traffic would know what I'm reading, if the IP address is a dedicated server for that web site only. Whether I use HTTP or HTTPS, they could infer that I'm interested in visiting the resta…
This is the techie version of "nothing to hide, nothing to fear". It's a pathetic argument and brings nothing to the table.
Just because you don't care about the NSA knowing you like McDonalds when you browse their menu, everybody else in the world shouldn't care about their government knowing they are gay (which, need I remind you, is an offense punishable by death in certain countries) when they browse an article on LGBT rights.
Because, if McDonalds doesn't need SSL for their menu, why would a writer need it for his small-audience blog?
I have to say, I actually disagree with this move. While I think the intentions sound noble, and I'm all for a more secure web, I also believe that a web browser has no business dictating that the entire web should be forced in HTTPs. I don't see any benefit in this type of blanket, all or nothing, type of approach. In fact, I see it doing more damage than good. Encrypting blogs, news websites, etc still makes no sen…
Why isn't encryption in the network stack, at a lower level than HTTPS?
I should be happy about this -- who wouldn't want the entire web to be encrypted -- but SSL is so broken for normal people. SSL is expensive (wildcard certificates run $70 a year and up), confusing (how does one pick between the 200 different companies selling certificates?), and incredibly difficult to set up (what order should I cat the certificate pieces in again?). If SSL doesn't change, this move will cut the li…
...me. It's insane we're even considering this. There seems to be a swell of consensus among tech people that encryption is good. It's not. It's not even the better of two evils. Encryption is secrecy not privacy. Encryption doesn't even work. It's the war on drugs all over again.
Earlier quoted context omitted.
Amateur web development shouldn't depend on having an account with a 3rd party service which can arbitrarily decide whether or not to sign your cert.
Well you still depend on 3rd parties to register a domain. And one to provide a connection, if not a server.
when I was experimenting with computers I had a WAMP executable on my LAN.
less parties involved the better.