51–60 of 268 posts
Good stuff. Anyone have a good recipe for setting up an HTTPS for one-off experiments in localhost? I generally don't because there isn't much of a compromise story there, but it's always been a security weakness in how I do tests and if Chrome is going to start reminding me stridently I should probably bother to fix it.
Earlier quoted context omitted.
There are dozens of us I guess that care about this kind of thing. I have never really understood the obsession with https for static content that I don't care if anyone can see I am reading like a blog post. HTTPS should be for things that matter, everything else can, and think should use HTTP when it is not necessary. Depending on yet another third party to provide what is IMHO a luxury should not be required, and…
> HTTPS should be for things that matter If that were the universal state, then it would be easy to tell when someone was visiting a site that mattered, and you could probably infer a lot about it by looking at the cleartext of the non-HTTPS side they were viewing right before they went to it.
Earlier quoted context omitted.
Silly question and one I should probably already know the answer to but never really got around to thinking through: are there practical concerns for not doing TLS in your home intranet? It means that if someone has patched into your local network they can access anything in there, but they have to get in first, right? So how concerned should one be in these scenarios (a) one has wifi with WPA2 enabled (b) there's a…
Main reason is that it's hard to get certificates for intranets that all devices will properly trust. Public CAs don't issue (free) certificates for internal hostnames and running your own CA has the drawback that Android doesn't allow you to "properly" use a personal CA without root, splitting it's CA list between the automatically trusted system CA list and the per-application opt-in user CA list. (It ought to be n…
Earlier quoted context omitted.
There are dozens of us I guess that care about this kind of thing. I have never really understood the obsession with https for static content that I don't care if anyone can see I am reading like a blog post. HTTPS should be for things that matter, everything else can, and think should use HTTP when it is not necessary. Depending on yet another third party to provide what is IMHO a luxury should not be required, and…
Just because you don't care doesn't mean nobody cares. I don't want anyone snooping on what I browse regardless of how "safe" someone thinks it is. My navigation habits are boring but they are mine , not anyone else's to see. A server has no way to know whether the user cares or not, so they are not in a position to choose the user's privacy preferences. Also: a page might be fully static, but I wouldn't want $GOVERN…
It does MITM between you and the HTTPS websites you browse.
Earlier quoted context omitted.
Depend on one less third party, you still depend on the DNS Root servers, your ISP / hosting, domain registry, etc.
Let's Encrypt pushes me to run its self-updating certbot on my personal server, which is a big no-go. I know about acme.sh, but still...
Like, the default for cars almost everywhere is you buy one made by some car manufacturer like Ford or Toyota or somebody, but usually making your own car is legal, it's just annoyingly difficult and so you don't do that.
Earlier quoted context omitted.
Just because you don't care doesn't mean nobody cares. I don't want anyone snooping on what I browse regardless of how "safe" someone thinks it is. My navigation habits are boring but they are mine , not anyone else's to see. A server has no way to know whether the user cares or not, so they are not in a position to choose the user's privacy preferences. Also: a page might be fully static, but I wouldn't want $GOVERN…
So... do you refuse to use the laptop supplied by your employer? It does MITM between you and the HTTPS websites you browse.
In fact it's just a regular laptop that I fully control and installed from scratch, straight out of Apple's store. As all my company laptops have been.
And if it was company policy I would refuse indeed. I would probably not work there in the first place, huge red flag. If I really had to work there for very pressing reasons I would do zero personal browsing (which I don't do anyways).
Not even when I was an intern at random corpo my laptop was MITMed.
Earlier quoted context omitted.
I run my blog in unencrypted HTTP/1.1 just to make a point that we do not have to depend on third parties to publish content online. And I noticed that Whatsapp is even worse than Chrome, it opens HTTPS even if I share HTTP links.
There are dozens of us I guess that care about this kind of thing. I have never really understood the obsession with https for static content that I don't care if anyone can see I am reading like a blog post. HTTPS should be for things that matter, everything else can, and think should use HTTP when it is not necessary. Depending on yet another third party to provide what is IMHO a luxury should not be required, and…
Earlier quoted context omitted.
Let's Encrypt pushes me to run its self-updating certbot on my personal server, which is a big no-go. I know about acme.sh, but still...
They're focused on the thing that'll get the most people up and running for the least extra work from them. When you say "push" do you just mean that's the default or are they trying to get you to not use another ACME client like acme.sh or one built in to servers you run anyway or indeed rolling your own? Like, the default for cars almost everywhere is you buy one made by some car manufacturer like Ford or Toyota or…