Tim Berners-Lee: https everywhere considered harmful

Re:Tim Berners-Lee: https everywhere considered harmful by Karunamon on Tuesday February 09, 2016 @03:24PM (#11068469)

So if I understand this right, Tim's main issue is that "s" is just going to lead users to think "oh, it's secure, I'm good right?" when really web security is a continuum, even on the level of certs - the browser doesn't meaningfully differentiate between domain validation, identity validation, and extended validation (EV), and less so on the technical characteristics of the cert (signing algo, ciphers chosen, etc.)

It's not that encryption is bad, it's that the https method encourages lazy thinking.

Call me pessimist, but I think that any method which relies on "user education" is doomed from the start. Any UX designer can tell you that users do not read error messages and just click by them ASAP to get back to what they were doing before the computer so rudely interrupted them.

[ Parent | on HN ]

Re:Tim Berners-Lee: https everywhere considered harmful by sbierwagen on Tuesday February 09, 2016 @03:35PM (#11068538)

No, he only gets to the point in one of the final paragraphs:

  The problem is of course that moving things from http: space into 
  https space, whether or not you keep the rest of the URI the same, 
  breaks any links to. Put simply, the HTTPS Everywhere campaign 
  taken at face value completely breaks the web.

Of course, in reality, anyone who moves to HSTS also adds a rewrite rule that redirects incoming http vistors to the https URI. In fact, Let's Encrypt even does it automatically: https://github.com/letsencrypt/letsencrypt/blob/master/letse...

His complaint is completely spurious.

[ Parent | on HN ]

Re:Tim Berners-Lee: https everywhere considered harmful by Ezhik on Tuesday February 09, 2016 @03:30PM (#11068508)

In a world where people disable their antivirus because a piece of malware told them to, a red broken padlock or even a scary error message will not help a whole lot.

[ Parent | on HN ]