5 ms·
I worked for an authority that issued digital certificates for SSL and digital signatures. It's not only about providing encryption but also about trust, when a
by jtafurth 1y ago
I worked for an authority that issued digital certificates for SSL and digital signatures. It's not only about providing encryption but also about trust, when a top level entity issues a SSL certificate, a number of identity validations are carried out, adding an extra layer or confidence on that website.
This may seem inconsequential for static websites without PII, however most browsers consider it important as it reduces the risk for all parties involved when encrypted communication is used and the content providers has taken basic steps for Identity verification.
There are logic flaws with this approach to security imo, but it's the most commonly used technique at the moment.
- sergiotapia 1y agoyou didn't answer the _why do we need all that for a drum beat making website_?
- jdiez17 1y agoUnauthenticated http is a vector for opportunistic malware. They don’t target specific websites, just inject evil.js wherever.
- otabdeveloper4 1y agoYou ISP sniffing and MiTMing traffic on the wire is the least likely vector of malware injection. ISP's are usually serious businesses with reputations and don't hack their own customers.
- latexr 1y agoThat “usually” is doing a ton of work. I remember Vodafone injecting scripts into webpages many years ago. While trying to find a source, I bumped into other shenanigans. https://www.simpleanalytics.com/blog/vodafone-deutsche-telekom-to-introduce-persistent-user-tracking https://www.simpleanalytics.com/blog/vodafone-deutsche-telek...
- otabdeveloper4 1y agoOut of all the bad actors on the Internet, your ISP is the least bad.
- deleted 1y ago[deleted]
- latexr 1y agoThat’s not a valid defence, it’s moving the goalposts and whataboutism. ISPs shouldn’t be bad actors at all and they have the ability to do the most harm.
- kube-system 1y agoMaybe if they live in a high income country with relatively strong consumer protections and are using their home ISP. But quite a lot of the internet is very much not that. In some places and on some networks, MiTMing http traffic for undesirable use-cases is routine.
- nklymok 1y agoAt least so that login / register data don't go to the middle man.
- otabdeveloper4 1y agoYou don't. But you will be penalized by Big Co for not supporting https. (It's effectively a "doing business on the Internet" tax. Thankfully not that expensive for small hobby projects now.)
- nerdponx 1y agoIt's literally $0 with LetsEncrypt.