Hacker News new | ask | show | jobs
by bilekas 248 days ago
> using http-only for decades, never seen “injections”

This has to be a rage bait comment, but anyway, how do you expect 'injections' to show up on 'http-only' ?

"Don't mind us, we're just sitting in the middle of your traffic here and recording your logins in plaintext"
1 comments
stop_nazi 248 days ago
I'm not talking about logins, it's supposed to be encrypted. If I go to read news that is open to an unlimited number of people, there is no need for encryption: the information is open.
link
Avamander 248 days ago
You assume that you will _never_ read something that might be out in the open but at the same time the fact that you're reading it might be the thing that needs protecting? A public invitation to a protest against your autocratic government, for example?
link
pKropotkin 248 days ago
A public invitation to protest against my authoritarian government should not turn on total paranoia mode and cipher the opening hours of the local bakery. It's unnecessary I'd also like to remind you that the vast majority of e-mails are still unencrypted
link
tialaramex 248 days ago
> vast majority of e-mails are still unencrypted

Kinda sorta. In transit most email is encrypted, the big mail providers all both speak and expect TLS encryption when moving mail. Almost everybody configures TLS encrypted IMAP if they use a client, or reads email over HTTPS

> A public invitation to protest against my authoritarian government should not turn on total paranoia mode

The expectations ordinary people have for how the web works are not met by the basic HTTP protocol. They need HTTPS to deliver those basic assumptions. Who decides the hours of the local bakery? Is it Jeff Bezos? HTTP says that seems fine, but HTTPS says no, the bakery gets to decide, not Jeff.

link
mailtls 248 days ago
Yes, many providers use TLS with SMTP. But that works with self-signed certificates.
link
Avamander 248 days ago
Can you say that for everyone though, that they should have a local bakery and use its opening hours? There are also more cases than that, where something being public does not mean that someone should see you looking at that info.

While the situation with emails is worse it does not mean it should be like that.

link