Comment by janosdebugs | Hacker News Reader

Comment by janosdebugs | Hacker News Reader

Parent Full thread

I'm always baffled by people arguing that we shouldn't use HTTPS. Have these people forgotten the times when mobile providers would "optimize" images (=compress them to death) or even insert advertisements? Or the times when simply being on the same network as someone with alterior motives could lead to your credentials being stolen?

I get it, certificates are hard, but having free certificates by Letsencrypt has probably been one of the most beneficial things that happened to the Internet in the last 10 years. If someone doesn't like it, please put in the work to come up with a better solution, not arguing for an even worse solution.

The author of this article doesn't propose anything workable. Mentioning SSH is ridiculous, it's not meant to access servers you don't know. Also, I have seen more than a few sysadmins who would easily be tripped up by a MITM because they'd just wipe their know hosts file at the first sign of trouble. And these are TRAINED people.

The days of plain HTTP were amazing, from the point of view of a teenage hacker that hung out at the public library of a college town.

At one point when Facebook started becoming popular, I had a script on my laptop that would grab session cookies from other people on the network and post things to the victims' facebook status like "I'm using unsecured wifi at the public library and I like to sniff butts"!

Learning that stuff taught me a lot about network security, and left me with a wariness of trusting networks that I don't control that I still keep close to heart long into my career.

The days of Firesheep

I think you're conflating two things.

Protecting against modification of data in-transit can be done without encryption. Signing the clear-text content allows the receiver to verify if the data is original. Encrypting hides the content from middle parties.

Signing clear-text content requires only slightly less infrastructure than encrypting it, for a less useful result. I don't want every party in between me and the destination server to be able to see the contents of my HTTP requests, even for static pages.

HTTPS is what makes the difference between an ISP being able to see that Alice is on WebMD and an ISP being able to see that Alice thinks she has a specific embarrassing illness.

Or even worse, Alice was just curious because of a conversation that happened and now her advertising profile will mark her as an insurance risk.

In the age of interest-based advertising is it really reasonable to suggest that we should let our network provider see every single website and subpage we visit?

This is really my problem with the "don't encrypt anything static" argument. I don't encrypt for security (or at least not primarily; I am not under the illusion that encryption makes my data unassailable) but for privacy.

There is a big difference between every jump between me and example.com seeing "example.com" or "example.com/so-you-think-you-might-be-heading-for-divorce.html" (just an example; I am happily married, in case my wife ever sees this).

That's not what the article is suggesting.

> My medical opinion: if it hurts, maybe you should stop doing it.

Which part of this is not suggesting we should stop using HTTPS?

I interpreted that as meaning stop using LE, not stop using HTTPS. But in context, I see it can be reasonably interpreted either way.

It doesn't matter which CA one is using as long as there is a CA that's freely available to anyone. The article makes very questionable suggestions such as this:

> For decades, users of SSH have had a system (save the certificate permanently the first time you connect, and warn if it ever changes) that is optimal in a sense: it works at least as well as any other solution. It's trivial to implement, is completely free, involves no third parties, and lasts forever. To the surprise of absolutely no one, web browsers don't support it.

I would interpret this as the author arguing against the entire CA system.

LetsEncrypt is FANTASTIC !

Reply on news.ycombinator.com