Re:Cached Chrome Top Million Websites
by rileymat2 on Saturday December 31, 2022 @11:50AM
(#34198194)
> email is sent over the clear but we are told to use https to connect to the website (for webmails) using https for "security"
This is not true, most is encrypted in transit. It is not end to end, because your email service stores them (perhaps encrypted perhaps not).
Edit: https://transparencyreport.google.com/safer-email/overview?h...
You can see 84% of outbound is encrypted. This probably is generally a good proxy for the state of email tls transport.
> why localhost should scream "insecure"
Localhost, even with HTTP, is a secure context: https://developer.mozilla.org/en-US/docs/Web/Security/Secure...
What tool is screaming at you that localhost is insecure?
Re:Cached Chrome Top Million Websites
by 2Gkashmiri on Saturday December 31, 2022 @01:18PM
(#34199075)
browsers. padlock icon is crossed out
I just tested this and don't see that. I compared http://neverssl.com to running "python3 -m http.server" and visiting http://localhost:8000
* Chrome: "Not Secure" on neverssl, "i" in a circle on localhost
* Firefox: Padlock with a red line through it on neverssl, page icon on localhost
* Safari: "Not Secure" on neverssl, no message on localhost
They may be using a self-signed cert so it’s https://localhost and the browser is flagging the cert rather than localhost itself.
i am not denying "security from snoops while paying with credit cards" and all that banking shit or messaging. heck, email is sent over the clear but we are told to use https to connect to the website (for webmails) using https for "security"...
sure sure security is all good and snazzy but i regularly come across websites who have had certs expired and the website makes it appear as if the sky will fall if i click on continue.
then we have ISPs who use DPI (my current ISP, reliance jio is doing it from day 1) so whats the point of pretending anyway?