Hacker News Reader

Comment by cesarb | Hacker News Reader

Like many, you are forgetting the other half of what TLS provides. It's not only confidentiality, it's also authenticity. It ensures not only that nobody can eavesdrop the connection within the browser and the server, but also that nobody can modify it, for instance to inject a piece of Javascript with a browser exploit.

View on HN

I thought I addressed that in a couple of different ways, but no I didn't forget.

I'm not saying that TLS doesn't have benefits. I'm just saying that a blanket policy is a bad idea for the US Government. If the policy for secure connectivity was "support-but-don't require" or "make your best effort to support" it would make more sense to me.

It's just basic connection integrity -- without HTTPS, there's no guarantee the user is actually getting the content that the site meant to send, and vice versa. Those kind of attacks really do happen, and at scale (e.g. Verizon XUID, or China's Great Cannon).

If it's at all interesting, I laid out in detail, with examples, why I've been comfortable taking a very hard line on deprecating HTTP:

https://konklone.com/post/were-deprecating-http-and-its-goin...

He's not necessarily "forgetting" it and I wish HTTPS-everywhere advocates would stop ascribing forgetfulness or bad motives. Some of us have a different opinion based on our own genuinely-held beliefs.

Requiring HTTPS everywhere is weighing certain factors above others. For many people, encryption and consequent lack of snooping/MITMing is an absolute which outweighs all other possible factors. That's fine. You're entitled to hold that belief. But please don't accuse others, who don't hold that as a trumps-everything absolute, of "forgetting" or (like the guy upthread who said "You being against HTTPS everything, is the same as being in support of MITM attacks somewhere") arguing in bad faith.

>Some of us have a different opinion based on our own genuinely-held beliefs

Such as?

Browsing a website with an adblocker in a public place may literally give me a virus.

That's what HTTPS everywhere protects against.

Browsing any infected website, HTTPS or otherwise, may give you a virus.

Right, but if it's HTTPS, only the website can give you a virus. If it's HTTP, the website can give you a virus, plus the owner of any network device your requests traveled through on the way to and from the website. That's often a lot of owners.

But he did forget the integrity benefits in his post. I understand that some people have different views, but if someone overlooks a significant point, it is ridiculous to get offended when someone else points it out.

Reply on news.ycombinator.com