Hacker News Reader

Comment by 1stop | Hacker News Reader

Even with HTTPS if you compromise the server, or the client you can do whatever you like... so my awesome server with all ports open and with login (on everything): admin password: 123 serves some content, but has a valid certificate, and the browser says: "This Connection Is Secure!"

Meanwhile a well managed server with no open ports, private key auth etc, but serves content without HTTPS, the browser says "This Connection Is Insecure!".

Seems a bit misguided to me. Also feels a little corrupt and profit driven (by CAs)... Why don't google offer free Certificates... seems an obvious (and trusted) way to spread more "Certified websites".

View on HN

I'm not sure I follow your argument. You do realize that you are talking about two different kinds of attack channels right?

Cleartext-based attacks and snooping (middleman, network peer) are simply far easier and far more likely.

You know those happen all the time, right? Literally all the time for certain users in certain places. A cleartext exploit is source-based (or route-based) and the server owner can't ever do anything to fix it besides forcing encryption (or shutting down completely to that source).

In contrast, a server compromise is destination-based and will theoretically only exist for the time that it is not known to the server provider.

On the other hand, cleartext-based attacks are also more easy to detect since the traffic is plainly visible. The maliciousness doesn't always have to be outside, despite all the focus on surveillance recently; and when it isn't, a "secure" connection makes it even harder to detect until it's too late.

Here's a recent demonstration of this principle - "smart TVs" phoning home via an unencrypted connection: http://arstechnica.com/security/2013/11/smart-tv-from-lg-pho...

If that was over HTTPS, would such data collection have been as obvious or even discoverable? It would be completely indistinguishable from any other "phoning home" - e.g. to legitimately check for software updates. The same encryption technologies that purport to protect us from mass surveillance... can be used to do it even more stealthily, and this is the main concern I have with making encryption ubiquitous.

Interesting, though I don't know how this is really relevant to the debate about whether it's appropriate to tell a user that HTTP is insecure but HTTPS is secure (the comment I was replying to questioned that exact point).

That's because the technology clearly exists to hide the type of phoning-home you are talking about. Any move toward more HTTPS for end users doesn't seem to increase that risk to me.

Reply on news.ycombinator.com