Re:Automatic HTTPS Enforcement for New Executive Branch .gov...
by brainfire on Friday January 20, 2017 @02:02PM
(#13446123)
Sorry, I'm not going to continue arguing with you. It's clear you don't understand the scope of what you're proposing is happening.
[ Parent
| on HN ]
Re:Automatic HTTPS Enforcement for New Executive Branch .gov...
by EdHominem on Friday January 20, 2017 @04:25PM
(#13447093)
I'm just saying you're making claims you cannot possibly verify. You say nobody is collecting your keys even though all you have is a lack of evidence either way. I also think you're probably, accidentally, right in this case. But only because I doubt you really have adversaries who care.
You're confusing being uninteresting with being safe. (Safety is numbers is irrelevant once you've been selected.)
> Sorry, I'm not going to continue arguing with you.
Stop clicking Reply.
Re:Automatic HTTPS Enforcement for New Executive Branch .gov...
by willstrafach on Friday January 20, 2017 @02:52PM
(#13446502)
Strangely, many tech folks seem to have normalized some very wild fantasies about what the NSA does.
Re:Automatic HTTPS Enforcement for New Executive Branch .gov...
by EdHominem on Friday January 20, 2017 @04:43PM
(#13447209)
I'm using the NSA as an example of a foe of sufficient capability, not saying that this is what they do (to our own agencies at any rate.) Someone who can trojan hardware, suborn any given person, etc.
I was hoping to use a very advanced force as an example to show that things that may sound secure aren't if your attacker has a certain level of resources.
Fwiw, most pen-testers would aso be able to bypass any such casually enacted system too, but that's less obvious so I had hoped to avoid that argument by going with an extreme example.