Re: HTTP is just fine

Hubert Kario <[email protected]> Tue, 24 Nov 2015 16:32:12 +0100

Newsgroups	gmane.comp.mozilla.security
Message-ID	<[email protected]>

On Tuesday 24 November 2015 14:17:23 Kevin Chadwick wrote:
> > > If you deliver your "information only" webpage over HTTP you have
> > > no
> > > guarantee that the data you send is the data the user gets. This
> > > is a
> > > very real issue with intermediates injecting all kinds of things
> > > into
> > > content (e.g. adding ads or replacing ads or injecting some kind
> > > of
> > > javascript doing whatever).
> > 
> > And this is a real issue.  When traveling I've seen javascript being
> > injected in site that I know don't have javascript or for a domain
> > that usually doesn't show up.  Https sites were never affected and
> > just worked.
> And yet mozilla have reduced the control over javascript in their
> browser without about:config!!! which is the real issue and nothing to
> do with https. Also, a VPN solution would be the right solution for
> insecure networks. That makes it a poor excuse for justifying https
> everywhere..

the ship called "web without javascript" have sailed long ago, reached 
its destination, was decommissioned, turned into tourist attraction, 
scrapped, turned into toothpicks and finally thrown into trash
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic

_______________________________________________
dev-security mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security

signature.asc (application/pgp-signature, 819 B)