281–290 of 307 posts
That feeling when you're arguing with an idiot, and the idiot isn't listening because he thinks it's YOU who's missing the point.
The important thing for all of us to remember, is that in any given conversation we may be idiot. Until I'm sure the other person doesn't know what they're talking about, I try and assume they're right.
Earlier quoted context omitted.
It says copyright 2016 on it...
No, it says "Copyright © 1994-2016 Nissan.com". The layout and copyright indicates it was probably created ~20 odd years ago, and hasn't received significant updates in years. The "2016" likely means they do minor/trivial updates now and again. Maybe it'll get a "2018" in the next 6 months or so too... :)
Earlier quoted context omitted.
Other than shopping privacy, who cares? As long as the checkout and account management pages are https, then I don't see the big issue here. I'm just not one of these people who think there are armies of people at the NSA/GCHQ spying on me. I'm also against forcing every website in the world onto https. Doing so will significantly raise the bar of accessibility for tinkerers and makers. If I had a webcam that showed…
> Other than shopping privacy, who cares? As long as the checkout and account management pages are https, then I don't see the big issue here. Please understand that you are wrong here. You need to go and read the article, and then perhaps some more writing around why it's important for the whole site to be served over TLS. Once you can read and understand the linked article and why what was described is a real issue…
Of course it was. Hence me using it in my 'straw-man' argument. Maybe I was too subtle.
You still haven't convinced me why I should move everything to TLS. Also, I do doubt you have other stuff to do, seeing as you answered my post, point by point...
Yes there are 'bad actors' but lets not get too paranoid here. We can't wrap everything up in TLS cottonwool.... where does it stop? Are we all too afraid to leave our houses without 'security' ? Do we now talk in code in public just. in. case. someone is overhearing what we say?
Earlier quoted context omitted.
Other than shopping privacy, who cares? As long as the checkout and account management pages are https, then I don't see the big issue here. I'm just not one of these people who think there are armies of people at the NSA/GCHQ spying on me. I'm also against forcing every website in the world onto https. Doing so will significantly raise the bar of accessibility for tinkerers and makers. If I had a webcam that showed…
> As long as the checkout and account management pages are https, then I don't see the big issue here. How do you arrive at the checkout and account management pages? By clicking on a link. If the whole site isn't encrypted, the link can be modified to point to false checkout and account management pages. HTTPS is not only for privacy, it's also for integrity.
ALL https says is 'hey i'm encrypted' it doesn't PROVE to the end user that it's really who it says it is. Extended Validation was supposed to fix this, but that ended up as an evil money grabbing exercise by the CAs so that didn't get the adoption it needed.
Until there's a secure validation banner at the top of the browsers that contains an unfakeable and unbreakable 'this is who I am' statement, then https is just a sticking plaster/bandaid over the whole problem.
And for those who say 'https prevents man in the middle attacks' - no it does not. There are several network level devices that by design decrypt/review/encrypt/spoof-cert traffic to clients (WAN Accelerators and Corporate Proxies being good examples) something that can only be overcome by Security Pinning the Certs to IP addresses... but again hardly anyone does that either.
About 8 years ago Natwest had a policy of having a "browser whitelist" which was rarely updated. Each time a security update for chrome or firefox came out it would be 2 weeks before online banking was accessible, and using any pre-release versions were out of the question. I complained and a member of the dev team phoned me up and after a long discussion about why this was madness he told me that it was better to us…
For some dumb reason the Bank of America website is ok with firefox on windows, but throws up a big red error message when you try to use firefox on mac. https://www.bankofamerica.com/information/supported-browsers...
Earlier quoted context omitted.
> Other than shopping privacy, who cares? As long as the checkout and account management pages are https, then I don't see the big issue here. Please understand that you are wrong here. You need to go and read the article, and then perhaps some more writing around why it's important for the whole site to be served over TLS. Once you can read and understand the linked article and why what was described is a real issue…
> Yes, it famously was: https://en.wikipedia.org/wiki/Trojan_Room_coffee_pot Of course it was. Hence me using it in my 'straw-man' argument. Maybe I was too subtle. You still haven't convinced me why I should move everything to TLS. Also, I do doubt you have other stuff to do, seeing as you answered my post, point by point... Yes there are 'bad actors' but lets not get too paranoid here. We can't wrap everything up i…
I don't need to, you can head off into the world believing what you want. You are however very wrong on this. Wether you decide you are going to continue to be wrong is of course up to you. I don't know you, do what you want.
> Also, I do doubt you have other stuff to do, seeing as you answered my post, point by point...
And I took time out of my day to do so, and yes, I do have other stuff to do.
> Yes there are 'bad actors' but lets not get too paranoid here. We can't wrap everything up in TLS cottonwool....
Taking adequate and proportional steps to secure our data, our identities and our money is not "wrapping everything up in cotton wool".
Risk and security are a sliding scale, we don't need to only talk about the extremes.
> where does it stop? Are we all too afraid to leave our houses without 'security' ? Do we now talk in code in public just. in. case. someone is overhearing what we say?
Another straw man argument, but just for fun:
> Are we all too afraid to leave our houses without 'security' ?
No would be the general answer, but it's going to depend on what your risks are. Who you are, where you live etc.
> Do we now talk in code in public just. in. case. someone is overhearing what we say?
Again, generally no. However if we have something that we want kept private we do either talk in code, or we wait until a more opportune moment.
I followed out this logic, and concluded that all pages on a site have to be encrypted, because someone may try to navigate to the login page from any page on the site. If the attacker can intercept one page they can lead the user to their own site (possibly even HTTPS, but with the wrong certificate). In a perfect worlds users would always check which certificate they're trusting (and have a plausible way to check w…
And the user shouldn't need to check the certs - if the CAs are trusted (yes there are problems there) then the domain name is enough.
A tweet from Troy Hunt is like a telelphone call from Brian Krebs: a sign your day is not going to get better, if you're a company infosec person.
I thought we are on "all pages should be HTTPS" since 2010 or something?