Re:Chrome 68 will mark all HTTP sites as “not secure”
by Cyphase on Thursday February 08, 2018 @11:28PM
(#16337885)
> The existence of vulnerabilities doesn’t negate the bullshit security theatre of certificate authorities.
I agree that the current CA system has flaws, but there are efforts such as Certificate Transparency[1] and DANE[2] attempting to improve or bypass the CA system. That said, just having encryption defeats passive eavesdropping, and even the current CA system of authentication raises the bar for active eavesdropping.
> Banning http is a great example of tossing the baby with the bathwater.
I'm not sure what you mean by that.
> Https is better, but there are still valuable use cases for unencrypted web traffic.
Like what?
[1] https://en.wikipedia.org/wiki/Certificate_Transparency
[2] https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...
Re:Chrome 68 will mark all HTTP sites as “not secure”
by dozzie on Friday February 09, 2018 @05:45AM
(#16339282)
>> Https is better, but there are still valuable use cases for unencrypted web traffic.
> Like what?
Things like this: https://utcc.utoronto.ca/~cks/space/blog/tech/BIOSViaHTTPSen...
Re:Chrome 68 will mark all HTTP sites as “not secure”
by Cyphase on Friday February 09, 2018 @01:42PM
(#16342764)
Let's take it as given that HTTP is the right answer in that situation; I'm not saying it is or isn't, but let's assume it is. We're talking about HTTP(S) in web browsers and client-side applications; no one is actually talking about _banning_ HTTP, e.g. blocking port 80 or filtering via deep packet inspection. If you have a use case where after careful thought you decide that HTTP is better than HTTPS, then fine. But HTTPS should be the default.
Re:Chrome 68 will mark all HTTP sites as “not secure”
by droopybuns on Friday February 09, 2018 @10:49PM
(#16345765)
The functional result for the chrome browser’s ui warnings will be almost indistinguishable from banning http.
Re:Chrome 68 will mark all HTTP sites as “not secure”
by Cyphase on Tuesday February 13, 2018 @03:45AM
(#16365660)
For web sites and web browsers, sure. But if you want to use HTTP for your BIOS updates (dozzie's example), then go ahead; I don't think anyone is seriously proposing to stop you. Just please make sure that it's done securely. Anyway, TLS is not enough for secure updates.
Banning http is a great example of tossing the baby with the bathwater.
Https is better, but there are still valuable use cases for unencrypted web traffic.
I am sorry this bugs you, but please note that your straw man is not the argument I’d make. Sometimes you need a low hassle web server. Renewing let’s encrypt certs is not low hassle.