News for hackers. Stuff that matters.

A comment on Chromium and Mozilla to enforce 1 year validity for TLS certificates. Parent comment

Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by DenisM on Sunday June 28, 2020 @01:59PM (#23670670)
If I was the bad actor I would simply purchase google ads in the name of the target business sending traffic to my own site with wonderful green padlock - it's cheaper and has bigger reach than trying to hijack TCP/IP traffic.

More to the point - if I am running a collection of Karl Marx works it is highly unlikely that he would request payments.

[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by staticassertion on Sunday June 28, 2020 @02:20PM (#23670865)
You're describing a completely different attack vector, which is the entire point - to push attackers to different attacks. if we eliminate HTTP, we can focus more effort on the attacks you're describing.

Regardless of the content, hijacking is a danger to users.

[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by DenisM on Sunday June 28, 2020 @02:31PM (#23670945)
It's worrisome that you injected yourself into the conversation between me and my users. How is this any of your business?
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by staticassertion on Sunday June 28, 2020 @02:40PM (#23671036)
I don't really understand your point. You're upset because I am advocating for your users despite not being one? I... don't care at all.

It isn't my business so I've done nothing to reach out to your users or interfere in your website. We're having a discussion about technology on a technical forum.

It is the browser developers' business though since they are tasked with protecting users from these specific threats.

[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by CydeWeys on Sunday June 28, 2020 @02:38PM (#23671016)
Because he might be a user too.

And are you blocking all Web traffic except from people who your users, somehow? If not, then everyone is your user.

[ Parent | on HN ]