Hacker News Reader

Hacker News

Comment by derekzhouzhen | Hacker News Reader

Full thread

derekzhouzhen

Seriously, no https in 2021? For a website dedicated to security?

View on HN

Ye was hoping to use that to get around our Sonicwall appliance blocking it for "Radicalization and Extremism"

If only there was a zine that taught hacking techniques to bypass firewalls...

what attack vector are you worried about? CIA man-in-the-middling a zine to make the articles less entertaining?

Thank you for this. The Love of Complexity is Real in this field. While I encourage and support the goals of anonymity and security everywhere, everything has its design envelope.

This is an e-zine of public content. Sure, "SoMeOnE cOuLd InTeRcEpT", but why bother? Even with encrypted sockets, logs would still show your IP going to the site. What information are we trying to protect or malicious activity are we trying to stop by using SSL?

... And is it worth the unfortunate webmasters having to deal with bullshit like LetsEncrypt's root certificate expiration and all the main of keystores and PKI management so random "Very Serious People on the Internet" can say "ah, they follow The Standard on security."

Controversial statement in 2021, I'm sure, but I think a use case for simple HTML over HTTP websites still exists. Your personal page with pictures of cats and your resume probably doesn't need to be some bastion of cybersecurity.

There are ISPs that will happily inject ads and tracking codes into pages you visit. This obviously doesn't work over HTTPS.

https://security.stackexchange.com/questions/157828/my-isp-b...

https://superuser.com/questions/902635/isp-is-inserting-ads-...

https://old.reddit.com/r/india/comments/8ry1k4/does_your_isp...

Even with HTTPS ad injection is still very common and it's not just happening in India. Even laptops sold here in America by big reputable brands have been known to preinstall things like layered service providers that proxy deciphered ssl communications through a server in a foreign country that injects ads. https://ag.nv.gov/uploadedfiles/agnvgov/Content/News/PR/PR_D...

What an incredible link and story I hadn't heard of at all. Reading that Lenovo literally knowingly installed self-signed certs on their laptops to send encrypted traffic to ad bots is one of the more horrifying device manufacturer findings I've ever seen.

Of course it does. You just have to install their certificate. Whole countries engage in this.

I mean, if you go out of your way to bork the system then yeah, I suppose it does.

For the peace of mind of the readers, if nothing else. Firefox has a https only mode:

https://blog.mozilla.org/security/2020/11/17/firefox-83-intr...

Someone might MitM the hacking 'zine's site to display a Google login prompt, and the user will obviously trust an apropos-nothing Google login prompt on a hacking 'zine's site, and so have their Google credentials stolen. /s

Well, points for coming up with something I hadn't thought of. Makes me grateful for my password manager filling things in based on domain.

EDIT oh shit, just revealed I use a password manager, please fire me if I ever reveal which one.

Fair point, but then, why bother with the PGP key?

Content isn't private the way email is.

Https creates a false sense of security as even the Chinese communist party is a certificate authority and various nation states are already caught abusing their privileges. Complementary, not using https also speeds things up and burns less fossil fuel.

Reply on news.ycombinator.com