Re:The Right to Lie and Google’s “Web Environment Integrity”
by saulrh on Monday July 31, 2023 @01:22PM
(#36945891)
With advertising eyeballs and third parties in the loop there is nothing that is not "commercial". Do you think that Comcast would have refrained from injecting ads and attack scripts if you'd been browsing Wikipedia or the Internet Archive or your own personal blog instead of Steam? Do you think that they'd have gotten less money for those impressions or extracted less of your personal data? The use case doesn't matter because the attackers in the HTTP vs HTTPS case have their own monetization scheme and their own attack chain and they _do not care_ whether something is commercial or private.
Re:The Right to Lie and Google’s “Web Environment Integrity”
by superkuh on Monday July 31, 2023 @02:17PM
(#36946665)
Nearly all commercial services require the execution of javascript. For example, I couldn't disable javascript in my Steam browser. But in my personal browsers I have javascript execution set to temporary-whitelist-only. Much like how I don't open and execute every email attachment sent to me. Comcast's injection attacks actually don't do anything without JS being run. I am not being hyperbolic in saying that 100% of malicious attacks on the web of the type you're floating use javascript and fail without it.
Personal and non-profit (non-incorporated) websites are mostly static html and files in directories and do not require everything everywhere be encrypted and verified. This "execute everything blindly" practice is only accepted because it's required for businesses which require JS execution. I reject this premise because no, it doesn't apply in all contexts and risks of MITM attacks (on personal websites) are very low once you question and mitigate it. The document web is much safer and requires less sacrifices than the application web.
But there is more to the web than just the commercial, institutional, and the like. Websites that are run by human people without profit motive and without any need to be constrained by the realities of CA TLS exist. The major browsers are all about money these days so they'll prioritize the safety of monetary transactions above user freedoms. But just because this is the right decision for an profit driven company or institution doesn't mean it's the right thing for everyone and should be applied to everyone. In fact doing so will ruin the web.