Most people don't need HTTPS for most sites. I think it's safe to say most security and privacy breaches are due to poor practices on the back end or by end users.
Protecting people who aren't at work but are using a potentially hostile network (public WiFi, etc.) from their own device is certainly a legitimate concern.
I've inspected my own HTTPS traffic a number of times using it including e.g. traffic from e.g. iPads where my Desktop was effectively acting as "the edge device". Of course, this is more for debugging than aggregate statistics/monitoring...
This won't let you inspect traffic secured via certificate pinning without additional reverse engineering to figure out how to replace the pinned cert, but it'll work fine for vanilla HTTPS / generic CA based stuff (e.g. all browser traffic.)
Replacing a cert doesn't get around cert pinning. That is the exact use case that cert pinning protects against.
For public certs: Yes, but that would only produce the desired effect if the site hadn't yet been pinned, and this was a first connection, or in the case of the pins having expired. In other words, the pinning can only be stripped out if there is no pinning already in place on the client.
However, this will soon be a moot point, as Chrome removes pinning in favor of cert transparency. This will reopen this security hole in browsers simply trying to be secure within captive portals and other insecure networks. Tor has pinning that would extend from inside the portal to outside, so that may be one option, but I don't yet know how sturdy that is.
Google is not doing this without interest, but I guess it overall is beneficial for us as well...
The hypocrisy here is amazing, too, because while pushing HTTPS, Google itself is actively following everybody around, tracking everything they do online.
The obvious one is that it makes your traffic hard or impossible to sniff.
What's often overlooked is that it also makes your session highly resistant to tampering by 3rd parties. These parties include:
1. Anybody who might have access to your home WIFI network.
2. Your Internet Service Provider. There's been plenty of documented cases where ISPs have injected 'harmless' HTML.
3. Any number of bad actors if you're using any kind of public WIFI.
4. National actors. That's the NSA in the United States, where we have clear evidence that they have been capable of intercepting unsecured connections and injecting unreleased attacks into targeted computers.
This is not tinfoil hat stuff.
The benefit of https is undeniably greater than the cost.
I'm not crazy about how Google throws their weight around in a lot of cases either. But in this case, I think they're doing the right thing.
Three things not two. Confidentiality, Integrity, and Authentication.
An ISP is by definition a man in the middle, and unless the user checks certificates for every page and resource they fetch then the ISP can inject their own certs and monitor traffic if they really want to.
And most of the time national actors like the NSA will have better ways of getting the information if they need it
In any case, I don't think "an ISP could inject their own certs very easily" is a fair characterization unless you put it on the same footing as "anyone with your email can get people to install malware easily".
As a concrete example, Lenovo were caught.
The article is about one practical measure that a browser maker has taken to improve the piece of user-facing software that they are responsible for, and some users of that software are applauding this improvement.
Having said that, I do accept your over all point that there is a lot of other work that still needs to be done in securing the web. As you suggest, that's not going to be easy, but let's not fail to fix the things that we can fix already.
If I'm passively browsing I don't really care too much. If I'm submitting forms, or working in a authenticated session, that's a different matter of course.
And as easy as it is to get a certificate these days, what does it really prove? It stops 3rd party snooping, but then again so does a self-signed certificate.
Let's Encrypt offered three of the Ten, but one was discovered to be flawed due to the way some major bulk hosting services are configured, so that leaves two (of Nine, since in practice any implementation of the Tenth Blessed Method is flawed the same way).
Even flawed Blessed Methods are far superior to the checking (basically none) we can reasonably expect from a normal person using a web browser. But still, improvements upon the Blessed Methods are a topic of public discussion, if you think you genuinely have a better way you should definitely let the CA/B Forum or m.d.s.policy know about it.
>It's just too easy to get them to think they really mean anything.
I'm not sure what you mean by this:
1. Are you saying that there is a vulnerability where you can get a valid certificate for a domain you don't own?
2. Do you mean the fact that valid owners of a domain can get a certificate easily?
If 1, please provide more info. If 2, why is that a bad thing?
Whether an EV certificate should do much more for trust than DV is a matter of some debate.
https://tools.ietf.org/html/rfc6108
Nobody is affected by this?
If the connection were HTTPS they could simply block it or redirect it wherever they want to give the same message. An ISP will always be able to MITM the connection.
The only thing?
I can think of four others off hand. That said, the “only” thing is pretty important in itself.
You know what people get bitten by? Hacked servers where the whole website is under a phisher's control or malicious website which downloads malware to your machine or sells your data (eg, Google, Facebook).
Maybe my knowledge is lacking, so please tell me what those 4 things are that you're being so elusive about. I suspect they are also as unlikely as MITM.
I'm not trying to protect myself from a targeted attack. I'm trying to protect myself from the enormous amount of scummy behavior in this whole industry. When I connect to my bank, I want my data to be secure not only against malicious activity, but negligence and incompetence. This is the threat model that HTTPS-Everywhere protects against.
Sure, people get bitten by viruses and phishes. But let's fix things one step at a time.
What bank do you use that doesn't use https already? Maybe it's time to change your bank rather than force every website in the world to switch to https.
How do you know? What is your groundless, evidence-free assertion worth to you?
> Nobody cares enough about me to do that.
I have detected Firesheeping on coffee shop networks in the past. Guess somebody cared about all the people in there, huh?
The conflation of Google using information collected about you in aggregate to provide advertising services and man-in-the-middle attacks on clients is dishonest, disingenuous, and at this point downright malicious. Stop.
Usually shitty public WiFi providers injecting ads.
Exactly. In the overall threat landscape that computer users face using HTTPS for cat videos and blog posts is meaningless.
Everyone who needs HTTPS already implemented it and any individual user who actually cares about security can use a VPN.