Re:EFF's HTTPS Everywhere Firefox plugin
by colonelxc on Friday June 18, 2010 @03:55AM
(#1441620)
I still consider it an attack.
There's lots of security reasons why a company would want to do that, both in protecting from malware and protecting from loss of company IP. Still, a huge trade off between privacy and security, and I am not willing to make that trade.
Maybe I would do it on my own connection, where I was both the MITM'er and the "victim", but the whole ssl system is built upon trust. It's a shaky foundation (do you trust all of the root certs in your browser?), but let's not start poking holes everywhere in it.
There's lots of security reasons why a company would want to do that, both in protecting from malware and protecting from loss of company IP. Still, a huge trade off between privacy and security, and I am not willing to make that trade.
Maybe I would do it on my own connection, where I was both the MITM'er and the "victim", but the whole ssl system is built upon trust. It's a shaky foundation (do you trust all of the root certs in your browser?), but let's not start poking holes everywhere in it.