Comment by phh | Hacker News Reader

Comment by phh | Hacker News Reader

Parent Full thread

I don't agree with the article (mainly because I consider that switching to https is free enough for anyone doing web hosting), but still, the point is pretty clear. https feels like red herring.

When we say "MITM" who is this man? In most cases, the only two valid responses really are "my ISP", and "the service's hosting provider".

https doesn't securize against evil hosting provider.

When using Chrome+https, vs Firefox+http, in one case you give your data to your ISP, in the other case to Google.

Google's primary focus is using my personal data. My ISP's primary focus is giving me Internet. Google is making fuss about https, to feed noise about Google itself.

Yes, I totally agree that best is to simply Firefox https. Yes, I'm totally dismissing the issue of rogue networks. But >80% of the population uses Google, I believe that less than 20% of the population is using rogue networks. What about the issue of broken WiFi security? Well, the point stands: https is so much of a red herring, that everyone forgets to fix WiFi.

> When we say "MITM" who is this man?

Anyone in `traceroute`, even indirectly. Your state. A rival state. Your ISP. Your neighbor at the coffee shop. A rogue employee at a CDN. A poisoned cache. That little thing that no one noticed in the closet. The latest malware on your router. Any of those threats on any path between the visitor and any resource on the page.

> I believe that less than 20% of the population is using rogue networks.

The network is hostile. Believing that it's not contributes to its insecurity: you get an architecture with a hard shell and a gooey center. One box in your "safe zone" gets popped and you're done.

So make the safe zone your box and nothing else. HTTPS helps you get there.

> What about the issue of broken WiFi security?

What about it? Someone snooping on your WiFi can't see through your TLS. That's a reason to support HTTPS, not to dismiss it.

I'm a bit confused as to what this has to do with Google? What advantage to they get by promoting HTTPS if all the other browsers support it as well?

Security is about being paranoid in imagining what different actors can do with varying levels of access. In this case, MITM is not always easy, but once they have access they can do bad stuff. As a webmaster, an attacker with this access can break your site by messing with your users.

By taking the simple step of using https, you can successfully reduce your attack surface and increase the difficulty of messing with your site.

>My ISP's primary focus is giving me Internet

No, their primary focus is to make money and they are finding that selling your data and showing you ads is profitable. Google hoards data so it can use it and I generally trust Google to keep the data secure. I don't trust my ISP to keep my data secure or not to sell it to everyone on the planet.

The man is also the hacker on the coffee shop WiFi intercepting traffic.

Reply on news.ycombinator.com