Hacker News new | past | comments | ask | show | jobs | submit login

No, but check out how XKCD is presented at the moment. It doesn't look like it's secure or insecure, it looks like http. I would happily read webcomics over a self-signed certificate if it was made easy for me.

We don't need identity verification on many sites, being resistant to passive eavesdroppers or transient active attackers (such as sites that present different SSL certs when accessed from a public wifi) is a nice to have as they prevent some attacks rather than none.




So you would be OK with your ISP adding popover flash video ads to XKCD for you? Or your boss calling you in, asking why you are reading comics instead of doing useful work?


No, I'm not okay with it, which is why I'm so against the near ubiquity of http which suffers from this exact problem on most mobile networks and many free wifi networks. The things you describe are not only possible but widespread.

By requiring a perfect solution to auth and ident (rather than iterative improvements) you are part of the problem.

Unidentified but authenticated connections should not be penalised compared to unauthenticated and unidentified connections. If someone MITMs a TLS connection with a forged certificate they can indeed do all the things that are trivial already with bog-standard http. If a client records TLS keys of sites they've already visited there is partial mitigation of this attack.

This doesn't have to have any effect of the CA scam business model, although obviously I would be in favour of a combination of key pinning and some sort of hand-wavey consensus determination for initial pins of arbitrary sites, but the fact that people are being forced to pay in order than browsers won't prefer plain-text over end-to-end encryption is absurd.


Generally you trust your ISP slightly more than strangers sitting near you.

No version of HTTPS has ever hidden what site you were visiting.


Really? http://arstechnica.com/tech-policy/2014/09/why-comcasts-java... doesn't bother you?

HTTPS sure does hide the URL's you are hitting. It may leak the domain name, and you are also resolving DNS entries in the clear, but there's a difference between the Wikipedia entry on puppies and on something more nefarious.


Feel free to stop with the strawman attacks at any point.

That said, I would prefer comcast ad injection to someone running firesheep. And hiding which comics I looked at for two hours isn't going to help my job very much.


No strawman here. I would prefer that nobody but the origin host can deliver content as the origin host.


You looked at a position saying it wasn't important, gmail or bank level important, to secure webcomics. You then argued that position was completely okay with having webcomic visits altered. That's a strawman.


I am not sure where you are getting this from, though it is very probably I wasn't completely clear. To clarify:

I believe all content (banks, GMail, XKCD) should be served over HTTPS and protected by a trusted certificate. Self-signed certs are not trusted and should not be (the problem of "should GMail give me a self-signed cert?" cannot be solved; you need some type of external trust).

Notice, I am not saying trusted and signed by a CA. We can replace the trust model and do something different to fix the currently broken CA system. However, I never argued and am not arguing that some content is OK to be served over plain HTTP.


No version of HTTPS has ever hidden what site you were visiting.

Eh? That's why SNI was invented, because pre-SNI https did not send the hostname in plaintext.


SNI wasn't put in to leak information.

The server sends the hostname in plaintext when it sends the certificate.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: