News for hackers. Stuff that matters.

A comment on Supporting Let’s Encrypt, the nonprofit making HTTPS free for all. Parent comment

Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free... by cpach on Monday June 14, 2021 @04:29PM (#27507895)
Security is about the ”CIA triad“, i.e. confidentiality, integrity, and availability.

For those sites you mention, confidentiality and availability will not really be impacted by HTTPS.

But the integrity can be.

Case in point: See this comment https://news.ycombinator.com/item?id=27507826

[ Parent | on HN ]
Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free... by t0mbstone on Monday June 14, 2021 @04:35PM (#27507951)
HTTPS is definitely useful for preserving the integrity of data between the server and the end user.

To be clear, I'm very pro-SSL and have used LetsEncrypt for years on all my domains. I was just taking issue with the notion that someone's web server serving static content could be breached just because it didn't have an SSL cert.

[ Parent | on HN ]
Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free... by Spivak on Monday June 14, 2021 @05:01PM (#27508248)
I mean define breached? I don't think anyone ever would say that without TLS you can use HTTP to drop into a shell on the server. But you can, largely arbitrarily, mess with the content of the site if you're adjacent to either the sever or client, or in the path between them. Maybe this matters a lot for someone's security, maybe it doesn't at all.
[ Parent | on HN ]
Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free... by gsich on Monday June 14, 2021 @06:02PM (#27508877)
Breached as in someone else has control over the server.
[ Parent | on HN ]
Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free... by cpach on Monday June 14, 2021 @06:37PM (#27509222)
If you can hijack the connection (i.e. MITM) you don’t need to control the server in order to compromise the integrity of the information.
[ Parent | on HN ]
Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free... by gsich on Tuesday June 15, 2021 @10:41AM (#27516201)
True, but this would not satisfy "breached".
[ Parent | on HN ]