Hacker News Reader

Comment by the_mitsuhiko | Hacker News Reader

> "Lawful intercept": sure, you have the right, good luck with that. We're not going to make the Internet less secure for the benefit of government interception; if anything, we're making it more secure because of the possibility of government interception.

Government censorship is happening if you want it or not. The main difference is now that there is a lot more collateral damage with SSL deployed.

> If you don't understand TLS, learn, or count on other people to have learned. That's no excuse for not using it.

I agree in the sense that anyone who runs a security critical website should deploy SSL and there is no excuse for not doing it. However what triggered the whole article was that more and more websites become completely impossible to use in the absence of SSL even for anonymous data access.

View on HN

> Government censorship is happening if you want it or not. The main difference is now that there is a lot more collateral damage with SSL deployed.

Good. Censorship and other attacks should be as noisy, obtrusive, and damaging as possible, so that we have more incentive to stop it (by both legal and technical means). Such attacks should not pass silently.

> However what triggered the whole article was that more and more websites become completely impossible to use in the absence of SSL even for anonymous data access.

Why do you need to use them in the absence of SSL?

Many ridiculously tiny devices still have enough power to run a simple TLS stack. And if you're really trying to access web services from some potato-powered device that can't run a TLS stack, you have much the same problems as a device that can't run a fully capable network stack at all. In either case, speak a simpler encrypted protocol (e.g. Bluetooth Low Energy, 6LoWPAN) to a local device, that can either provide the services you need or access them on your behalf.

> Good. Censorship and other attacks should be as noisy, obtrusive, and damaging as possible

Agreed. It's human nature to not bother to speak up when a group you're not a part of is attacked. If widespread encryption means that more people will be affected when governments try to censor traffic, then I'd say we have one more argument for widespread encryption. http://hmd.org.uk/resources/poetry/first-they-came-pastor-ma...

>> Government censorship is happening if you want it or not. The main difference is now that there is a lot more collateral damage with SSL deployed.

Excellent. It means that it's a lot more out in the open and noticeable.

>> owever what triggered the whole article was that more and more websites become completely impossible to use in the absence of SSL even for anonymous data access.

Also good, making sure there's a lot of uninteresting stuff under encryption means that the interesting stuff stands out less.

Also makes it harder for ISPs to alter content or inject advertising. A good thing.

>However what triggered the whole article was that more and more websites become completely impossible to use in the absence of SSL even for anonymous data access.

How would you bootstrap a secure encrypted login for a user who was browsing the site without SSL? I agree with you that anonymous data access is often encrypted unnecessarily, but in practice deploying HTTPS is an all-or-nothing deal.

> How would you bootstrap a secure encrypted login for a user who was browsing the site without SSL?

If you have a website where users sign in you are pretty much left with SSL from the sign-in form on but you can move an indirection between the sign in and out so that a user has a chance to verify they are authenticating on the right site. Fundamentally there is no difference from the user's perspective for as long you are okay with moving the log-in box to a secure URL where the user can check the authentication.

I mean that while browsing unencrypted, the user can be phished away from the site quite easily.

>Government censorship is happening if you want it or not. The main difference is now that there is a lot more collateral damage with SSL deployed.

Good. Make the censorship visible. Make it all or nothing. Force people to move to technologies that cannot be censored (or that at least are more resistant).

The alternative is to let the government censor everything they want and let people see only what the government approves of, with the latter just being easier to deploy and switch to the former if it ever crosses the line.

Reply on news.ycombinator.com