Consider disabling HTTPS auto redirects

Re:Consider disabling HTTPS auto redirects by strogonoff on Monday June 27, 2022 @11:09AM (#31895632)

Plain HTTP is synonymous with trust. In an ideal world where no one would snoop or mangle responses, it should be enough.

In our still-imperfect world with potential MITM attacks, sometimes that trust is not warranted. However, one still should be able to choose to trust own connection. I don’t want this choice to be made for me with no way to appeal.

[ Parent | on HN ]

Re:Consider disabling HTTPS auto redirects by Sohcahtoa82 on Monday June 27, 2022 @12:06PM (#31896544)

It's not just your own connection, it's every device your packets flow through.

And if you use Comcast/Xfinity, then your own connection can't be trusted. They've been caught injecting messages in plaintext HTTP web pages.

[ Parent | on HN ]

Re:Consider disabling HTTPS auto redirects by strogonoff on Monday June 27, 2022 @12:16PM (#31896704)

I may use a self-provisioned VPN, but actually this doesn’t matter. The point is that the user has no choice, regardless of circumstances.

As an example (although it’s whataboutism), the option of using insecure SMS 2FA is routinely offered in much more sensitive contexts compared to the option of using plain HTTP to read static text content—yet the former is considered acceptable but the latter isn’t.

[ Parent | on HN ]