Dangerous Web Security Features

41–42 of 42 posts

Re: Dangerous Web Security Features

#41

Post by sjwright » Mon, Apr 22, 2019, 5:55 AM UTC

zzo38computer wrote: post #40

sjwright wrote: post #39

Earlier quoted context omitted.

> I hate HSTS and will not use it. HSTS is just a flag. What you "hate" is that a piece of software under ~YOUR~ control (the web browser) happens to be correctly enforcing the intent of that flag. If you don't like HSTS, it is ~YOUR~ choice whether you use a web browser that will follow your instructions or someone else's. If your web browser does not offer a method to disable HSTS like Firefox does, switch to a bro…

I know that about the flag, and managed to hack Firefox so that HSTS won't work. (Although I wrote a document how to write a better web browser program, but it isn't implemented.) Trust between whatever (and other options about what features to enable/disable/alter, such as what fonts to use, any kind of URL redirections, etc) should be defined by the user. There are several reasons you may wish to alter the settings…

All of the above assumes that the broader population are well informed about the nuances of digital security. The reality is most people have better things to do.

As for your third paragraph—I would agree that banks should act more like APIs and less like their own countries. But that is independent from the use of a protocol. Arguing between TLS (HTTPS) and SSH borders on bikeshedding.

The reality is more than a billion people are successfully using HTTPS to safely and securely manage their money, and HSTS is improving the guarantees around that security. I'm sure you've solved every security and trust risk with this hypothetical bank-over-IRC-over-SSH protocol with non-mandatory security... but I'm not yet convinced.

Re: Dangerous Web Security Features

#42

Post by zzo38computer » Mon, Apr 22, 2019, 6:04 AM UTC

sjwright wrote: post #41

zzo38computer wrote: post #40

Earlier quoted context omitted.

I know that about the flag, and managed to hack Firefox so that HSTS won't work. (Although I wrote a document how to write a better web browser program, but it isn't implemented.) Trust between whatever (and other options about what features to enable/disable/alter, such as what fonts to use, any kind of URL redirections, etc) should be defined by the user. There are several reasons you may wish to alter the settings…

All of the above assumes that the broader population are well informed about the nuances of digital security. The reality is most people have better things to do. As for your third paragraph—I would agree that banks should act more like APIs and less like their own countries. But that is independent from the use of a protocol. Arguing between TLS (HTTPS) and SSH borders on bikeshedding. The reality is more than a bil…

You are correct about that; you could do HTTPS (or otherwise TLS) too would also work, to define such API; it does not have to be SSH.

(Actually, now that I consider, HTTP requests (with HTTPS) might be better than SSH anyways for many of the things being done, such as downloading a bank statement. So, it may likely do better. However, the common authentication protocols are better in SSH, but similar kind of authentication protocols is probably still possible with HTTPS too, just it does not seem to be as commonly used, but perhaps it should be.)

Post reply on HN