News for hackers. Stuff that matters.

A comment on Chrome 68 will mark all HTTP sites as “not secure”. Parent comment

Re:Chrome 68 will mark all HTTP sites as “not secure” by peterwwillis on Friday February 09, 2018 @10:16AM (#16340749)
You don't need HTTPS to verify integrity. HTTPS actually adds attack vectors, complexity, and removes useful functionality like proxies. And like another commenter mentioned, most malware is delivered from an authentic site anyway.

HTTPS evangelists are basically playing a game of political ideology shrouded as concern for safety. I think they care more about their own privacy than they do the functionality, security, and maintenance required for HTTPS sites.

It's also not coincidental that Google has a vested interest in keeping all traffic surrounding their services hidden or obfuscated: traffic content and metadata is money. Google is basically eating the lunch money of ISPs' passive ad revenue. (This is also part of why they want to serve DNS over HTTPS)

[ Parent | on HN ]
Re:Chrome 68 will mark all HTTP sites as “not secure” by floatboth on Friday February 09, 2018 @01:29PM (#16342622)
How else would you practically verify integrity for web browsing?

What's wrong about caring about your privacy?!

Why the hell do ISPs deserve ad revenue? I don't like Google either, but ISPs that want to tamper with connections to inject their ads can fuck off and die in a fire. That is more unethical than anything Google has ever done.

[ Parent | on HN ]
Re:Chrome 68 will mark all HTTP sites as “not secure” by peterwwillis on Friday February 09, 2018 @02:38PM (#16343206)
> How else would you practically verify integrity for web browsing?

Download a signature once, verify any file before rendering it. You could even control this behavior using an HTTP header if you wanted granular control. It would be a trivial extension.

Today, nobody verifies that content was created by the author. That content can be subverted on the web server, and this is how malware is distributed today. Verifying content with a signature would actually be more secure than just TLS.

> What's wrong about caring about your privacy?!

Ignoring all the other concerns for the sake of it, is what's wrong.

> ISPs that want to tamper with connections to inject their ads can fuck off and die in a fire. That is more unethical than anything Google has ever done.

Google reads your e-mails and search history and tracks where you go on the internet, and sells the information to advertisers, who then display the ads no matter where you are or what you're looking at - including over HTTPS pages.

[ Parent | on HN ]
Re:Chrome 68 will mark all HTTP sites as “not secure” by nsgi on Monday February 12, 2018 @07:54PM (#16363859)
That functionality doesn't exist today, so it would be a new protocol. One that would be almost as complicated as HTTPS, would be starting from zero as opposed to the 50% usage of HTTPS on the internet, would require new code to be written which hasn't been thoroughly tested for security issues and would provide inferior assurance to HTTPS. All for the sake of being "simpler."

With regards to signing content, this already exists in the form of code signing. Given the amount of software that isn't signed I doubt it would be practical for anything else e.g. blog posts.

[ Parent | on HN ]