undefined | Better HN

0 pointssuperkuh1y ago0 comments

If that's your threat model then CA TLS is going to make things even worse for you because now the nation state pressure can be centralized and directed through the CA.

There are trade-offs but HTTP has it's place. HTTP is far easier to set up, more robust, far more decentralized, supports far more other software, and has a longer lifetime. For humans who aren't dealing with nation state threat models those attributes make it very attractive and useful.

We should not cargo cult the requirements for a multi-national business that does monetary transactions and sends private information with a website run by a human person for recreation and other humans. There is more to the web than commerce and we should design for human persons as well as corporate persons.

0 comments

ric2b1y ago

ISP's have been known to inject ads into HTTP pages, and ads are the least malicious thing that could be done by an ISP or wifi hotspot.

HTTP MITM is way too cheap and accessible to pretend you're not vulnerable to it constantly or that you need to be a target, you don't.

ozim1y ago

Were you familiar with Snowden revelations?

How NSA was just putting gear in ISPs or nodes where are internet gateways to pass all traffic through their automated tooling?

It was not monetary or business it is not “threat model” thing. Having all traffic encrypted is a must for basic human freedom.

superkuhOP1y ago

It is a human freedom thing. Having to get continued permission to host a visit-able website from a CA is very un-free. That's why HTTP+HTTPS is so good. The best of both worlds with the downsides of neither.

Passive massive surveillance is by definition not doing active MITM targeting.

j / k navigate · click thread line to collapse