Hacker News Reader

If a federal site can survive being DDOSed, it can probably survive normal traffic.

And I fundamentally disagree with the premise that there are people who do not deserve privacy. I can not think of a single person I would wish complete exposure of their lives upon.

View on HN

Some people do not have the rights to online privacy. For example, when accessing a website from the library of a jail. The authorities want and need to know what you do, this for some obvious and understandable reasons. I agree this is a particular case, but this is still a case for allowing a website (as long as this is anonymous usage of it) to be available without SSL.

Jails can still use MITM monitoring proxies without disabling SSL: they just have to install certs on the machine.

Does it work with sites like Google from Google Chrome where browser knows about their public keys? I think that this will be wide practice in modern browsers.

HSTS/HPKP headers could be stripped by proxy but preloaded public key list probably will require custom browser build.

Yes, it does. Google intentionally adds exceptions from error reporting in the case a root CA was added to the OS.

Reply on news.ycombinator.com