News for hackers. Stuff that matters.
Re:Automatic HTTPS Enforcement for New Executive Branch .gov... by brainfire on Friday January 20, 2017 @02:02PM (#13446123)
Sorry, I'm not going to continue arguing with you. It's clear you don't understand the scope of what you're proposing is happening.
Re:Automatic HTTPS Enforcement for New Executive Branch .gov... by EdHominem on Friday January 20, 2017 @04:25PM (#13447093)
I'm just saying you're making claims you cannot possibly verify. You say nobody is collecting your keys even though all you have is a lack of evidence either way. I also think you're probably, accidentally, right in this case. But only because I doubt you really have adversaries who care.

You're confusing being uninteresting with being safe. (Safety is numbers is irrelevant once you've been selected.)

> Sorry, I'm not going to continue arguing with you.

Stop clicking Reply.

Re:Automatic HTTPS Enforcement for New Executive Branch .gov... by willstrafach on Friday January 20, 2017 @02:52PM (#13446502)
Strangely, many tech folks seem to have normalized some very wild fantasies about what the NSA does.
Re:Automatic HTTPS Enforcement for New Executive Branch .gov... by EdHominem on Friday January 20, 2017 @04:43PM (#13447209)
I'm using the NSA as an example of a foe of sufficient capability, not saying that this is what they do (to our own agencies at any rate.) Someone who can trojan hardware, suborn any given person, etc.

I was hoping to use a very advanced force as an example to show that things that may sound secure aren't if your attacker has a certain level of resources.

Fwiw, most pen-testers would aso be able to bypass any such casually enacted system too, but that's less obvious so I had hoped to avoid that argument by going with an extreme example.