Re:When did POP and IMAP become a “legacy protocol?”
by Handytinge on Tuesday October 04, 2022 @09:21AM
(#33079945)
Firmly disagree.
Anyone can use any protocol they wish to, that's the beauty of the internet.
Re:When did POP and IMAP become a “legacy protocol?”
by verisimilitudes on Monday September 26, 2022 @01:35AM
(#32979757)
Hey, fellow genius on Hacker News, do note that TLS doesn't protect against state actors, because they can very easily manipulate certificate authorities, and a malicious certificate authority completely removes most protections TLS supposedly provides.
Re:When did POP and IMAP become a “legacy protocol?”
by foverzar on Monday September 26, 2022 @02:20AM
(#32980035)
It could, if the CAs were globally distributed. Unfortunately currently they are all under the US influence.
Re:When did POP and IMAP become a “legacy protocol?”
by tsimionescu on Monday September 26, 2022 @04:26AM
(#32980723)
It's enough to compromise one CA for TLS to be entirely defeated - any CA can sign a certificate for any site, and TLS implementations will accept it. The only defense is pinned certificates, but that comes with its own problems.
Re:When did POP and IMAP become a “legacy protocol?”
by Avamander on Monday September 26, 2022 @05:41AM
(#32981111)
Certificate Transparency is enforced, so it'd be quite easy to detect that compromise by now.
Re:When did POP and IMAP become a “legacy protocol?”
by tsimionescu on Monday September 26, 2022 @07:09AM
(#32981587)
Sure, but still somewhat after the fact.
No, no, no, no, no, no, no.
ALL Web traffic should be https (or http/2 or /3). If you connect to a site that uses insecure http, ANY link between you and that site can easily snoop on traffic and even inject different content. You CANNOT be sure that the content you see is what was originally served by the server, and you can certainly expect that state actors will be noting that you viewed this content, and building a profile on you based on that information.