News for hackers. Stuff that matters.

A comment on Supporting Let’s Encrypt, the nonprofit making HTTPS free for all. Parent comment

Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free... by bombcar on Monday June 14, 2021 @05:40PM (#27508673)
Most anyone who is in a position to reliably MITM an HTTP site would also be in a position to install a certificate source (either as part of a “install this to access the web” program or similar).

It’s a necessary level of defense but it is NOT sufficient- especially if you never check certificates.

[ Parent | on HN ]
Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free... by moosingin3space on Monday June 14, 2021 @07:08PM (#27509513)
I highly recommend you do a search for Firesheep - the tool that really started the push for HTTPS everywhere. You're right that a malicious network operator would be in a position to request users install root certs, but the problems with plaintext HTTP are deeper than just that.
[ Parent | on HN ]
Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free... by jlokier on Monday June 14, 2021 @07:06PM (#27509493)
Not really. In my experience it's always been an ISP that modified the HTTP in transit (to add their own advertising and analytics JavaScript inline), and the ISP didn't have the ability to install a certificate source.
[ Parent | on HN ]