News for hackers. Stuff that matters.

A comment on GNU Radio 3.9. Parent comment

Re:GNU Radio 3.9 by naf77 on Monday January 18, 2021 @12:55PM (#25824461)
HTTPS-everywhere, along with constant monitoring and reporting of certificate chains by the browser, are designed to protect against QUANTUM attacks [1], which, ~10 years ago, was being scaled to support million of simultaneous attacked devices.

It is not cargo-cult security.

[1] https://en.wikipedia.org/wiki/Tailored_Access_Operations#QUA...

[ Parent | on HN ]
Re:GNU Radio 3.9 by superkuh on Monday January 18, 2021 @12:58PM (#25824502)
HTTPS Everywhere (client side option) is great. HTTPS only (server side option) is not.
[ Parent | on HN ]
Re:GNU Radio 3.9 by naf77 on Monday January 18, 2021 @01:05PM (#25824606)
HTTPS only is a "Fail Closed" system, ie it blocks access in case of failure. This is safe for the general population.

HTTPS/HTTP mixed support is a "Fail Open" system, ie it allows (unencrypted) access in case of failure. This is unsafe for the general population, see QUANTUM (above).

[ Parent | on HN ]
Re:GNU Radio 3.9 by superkuh on Monday January 18, 2021 @04:42PM (#25827008)
You can argue for wearing a bulletproof vest at home if you're an iraqi nuclear scientist. But for most people it doesn't make sense and does more harm than good.

In the same way, HTTPs only, *requiring* a system that "fails open", is bad for the general population. HTTP+HTTPS, yes, definitely. HTTPS only, no, only for sites and contexts where the rigid security is justified.

[ Parent | on HN ]
Re:GNU Radio 3.9 by patmorgan23 on Monday January 18, 2021 @11:46PM (#25830094)
Yes context is key. Its ok for wikipedia to fail back to HTTP but not for bank.
[ Parent | on HN ]