Re: HTTP is just fine

Hubert Kario <[email protected]> Fri, 20 Nov 2015 12:49:14 +0100

Newsgroups	gmane.comp.mozilla.security
Message-ID	<[email protected]>

On Friday 20 November 2015 10:05:07 Kurt Roeckx wrote:
> On 2015-11-19 17:40, Hanno Böck wrote:
> > If you deliver your "information only" webpage over HTTP you have no
> > guarantee that the data you send is the data the user gets. This is
> > a
> > very real issue with intermediates injecting all kinds of things
> > into
> > content (e.g. adding ads or replacing ads or injecting some kind of
> > javascript doing whatever).
> 
> And this is a real issue.  When traveling I've seen javascript being
> injected in site that I know don't have javascript or for a domain
> that usually doesn't show up.  Https sites were never affected and
> just worked.

not to mention that because middle boxes just love to put their grubby 
fingers on HTTP traffic, it actually makes it _slower_ than HTTPS for 
the average user

see for yourself:
http://www.httpvshttps.com/

-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic

_______________________________________________
dev-security mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security

signature.asc (application/pgp-signature, 819 B)