So I'm curious, is this appliance on a private network or something? That's they only way I see that it doesn't bring any benefit. If it is going out onto the public internet, I would think encryption and integrity would be a huge concern.
There's just tons of stuff out there that exists where, honest-to-gosh, credit card details and HIPAA compliance do not happen. I know Hacker News leans very heavy toward the Silicon Valley side, but I swear stuff happens in the flyover states that involves computers. It might be pedestrian and unexciting, and nobody will IPO, but they do happen.
I've never seen it happen when I used it from home, I've never heard of it happening. It's a nobody cares situation.
Now, I have had to defend university servers from quite a lot of things, in a large variety of situations. But this? This has never shown up as an issue.
For many things crypto itself is going to be a bigger security-risk than what it’s defending against.
Following that, there must be a crypto-averse bank you're using to deposit your paychecks, right? And if so, can I have the URL to their public and unencrypted site?
On the other hand, the overly-complex crypto stacks might be the thing preventing most internet-scale MITM-attacks from being successful.
And sure there are other kinds of bugs like downgrade attacks but even if an attacker can downgrade you to use RC4 and decrypt data in real time, you are now in the same situation as you were when not using crypto at all. Not even that: to be in the same situation as with no crypto at all, the attacker would need to downgrade/break encryption and signing because breaking only one of both would still not allow modifying the data stream.
Bugs in crypto stacks that allow code execution or memory reads/writes on the server or client are rather rare.
And incidentally, if your ISP decided to collect that information and share it with the government, they could collect that information with a MitM attack that would give you absolutely no indication that a MitM attack, so your assertion that "this has never shown up as an issue" doesn't hold much weight.
> I've never seen it happen when I used it from home, I've never heard of it happening. It's a nobody cares situation.
It’s literally asking everyone to have an anti-nuclear defence-system at home. Utterly pointless and a waste of effort.
Yep, I live and work in one too! That's why I asked what it was. This is an edge case where I agree, it would add little utility. However, like you said, there are a lot of cases where there should be this sort of compliance but is not.
I actually thought you were referring to PLCs for public infrastructure or something similar to that. Sadly, I have gotten in arguments for people who do not want to even add encryption to talking to a PLC on the public internet.
Overall, I have had to support some very odd security situations, back in the day. As an example: someone's philosophical position somehow got translated to an org-wide policy forbidding firewalls. I'll repeat that: they forbid firewalls. Because we were "open." And I had to support FTP sites. On Windows NT. I managed it without incident through layers of security and care, with watchfulness and compliance.
PLCs? Yeah, I'd lock that down like crazy.
Oh! That's actually a great little encapsulation of the larger problem here.
Before COVID hit, I was a volunteer teacher at a Girls Who Code class at a library. Most of the library's computers were running Windows 7, which of course lost security updates in January.
One of the other volunteers remarked: "Someone needs to update those to Windows 10."
I answered: "Someone should update them, yes. But no one is going to."
I don't even know if those old laptops could run Windows 10. Should the library really spend money on replacing all of them? As opposed to buying books, or teaching more students?
---
There was an article on Hacker News some time back about how the NYC subway system runs OS/2. A lot commenters said this is a huge security risk—sure, it's ostensibly not connected to the internet, but who really knows?
But, what should be done about it? It doesn't make sense to switch out the architecture of a city's subway system every 30 years—I'm not convinced it makes sense even every 50 or 100 years. How do you set up a system like that?
You can acquire a permanent license for Windows 10 LTSC through Microsoft's Open Business licensing program. There is a minimum initial purchase quantity of 5 SKUs, but any competent reseller will just pad your order with the lowest-price-in-the-catalog SKU to get you up to that minimum.
The Open License Agreement itself expires in two years, meaning that you're subject to the minimum 5 SKU purchase to start a new one at the end of 2 years. During the term of the Agreement you can purchase licenses piecemeal. Regardless of the Agreement's term the software you license thru the program is perpetually licensed.
This won't make it any cheaper, though. Windows 10 LTSC is ridiculously expensive, to me, for what it is. Licenses acquired through this program are transferable to new hardware, at least. That's why I used it a lot over the years. Buying Office and transferring it to a new PC once in the useful life ended up being a cost savings over buying OEM Office with the original and replacement PCs.
I agree, they're costly.
The idea that you have to go through a dealer, join some overcomplicated volume licensing programme, possibly buy extra stuff, and probably pay a premium for the privilege just to get a legitimate copy of LTSC to use doesn't sit well with us.
If Microsoft offered LTSC as a one-time, off-the-shelf purchase with no strings attached, I expect we'd buy several copies immediately. It seems to be the only version of Windows 10 we might actually want, other than for having the same as our customers/clients for testing purposes. But as a small business, we have limited time and resources, and we have remarkably little interest in playing big business games.
As a direct result of that decision, they have essentially lost our business, just like certain other large software organisations whose names start with A that have adopted similar customer-hostile practices in recent years. There are viable alternatives for almost anything these days when you're a small business with the flexibility to make intelligent policy decisions about your hardware and software purchases on a case by case basis and, if appropriate, to change those policies however you want later on.
I will say that I've never found the Open License program to be a tremendous hassle. There was good cost savings to be had using transferable licenses, and the product use rights and other terms and conditions were clearly spelled-out. Dealing with resellers was the worst part of it, but I managed to find good resellers who would mostly just do what I asked for and not hound me with sales-gerbil nonsense. The volume license management website was actually fairly nice, and was useful for keeping track of a Customer's license inventory.
I've had a hard time getting much free/open-source software adoption in my small business Customers. They almost always have a mission-critical application that keeps them locked to Windows (or SQL Server, Office, Exchange, etc), and no budget or desire to finance software development. The value proposition of spending money on the proprietary software is often just good enough to make it worth the cost and draconian licensing.
That's why I encrypt everything: you just never know what kind of things are going to catch the attention of the wrong people.
Do you also feel the same way about search engines? Should my Google searches be encrypted?
Seeing that tells me it is not just some sort of public website, and not something you just want any random person to access. Think like PLCs controlling public infrastructure (this is a real scenario in places) If it is on the public internet, I imagine the first thing you go is login to it. If it is HTTP, those credentials are going over the internet in the clear.
The first thing you do is see if the book exists. Logins go to a different system, for something else.
If you stop thinking of the Internet as a place where people put in login information and credit card details to get products shipped to them, it becomes a great deal wider and more complex. Sometimes websites are just ... present to provide information. It might be backed up by a database but that is it.
The wikipedia.org website just provides information instead of data input of private sensitive information such as credit-cards. But this doesn't mean high-value targets like Wikipedia should serve plain http.
That's fine and I agree with "http" sometimes being a valid choice.
I disagree with how you argued it using phrases like "sometimes a website just provides information instead of credit-cards". The "provides information" is a flawed mental model to base a decision tree on and just confuses people about why https is also important for non-credit-card data.
Your later qualifications specifying "threat models" is much better argued. Yes, my internal git web server doesn't need https and I don't want the hassle of getting LetsEncrypt certificate for it. And a toy website on my Raspberry Pi on my local private firewalled NAT'd LAN doesn't need https either.
It's not about "public information"; it's about "threats".
Why are you confusing https encryption with private vs publicly available information?
Let's unpack your concepts a bit using COVID-19 as an example[0]. The information that Wikipedia displays about COVID-19 is public information instead of top-secret classified files. But you'll notice that wikipedia serves its pages as "https". Think about why they do that. Even if you manually type "http" without the "s" in your web browser url bar[1], Wikipedia will still redirect you to "https". Why do they do that if COVID is public information?
As a web surfer, I also want wikipedia to serve its pages with "https". Think about why I would want that.
[0] https://en.wikipedia.org/wiki/COVID-19_pandemic
[1] this will still redirect to https: http://en.wikipedia.org/wiki/COVID-19_pandemic