Re: HTTP is just fine

Hubert Kario <[email protected]> Tue, 24 Nov 2015 19:19:52 +0100
Newsgroups	gmane.comp.mozilla.security
Message-ID	<[email protected]>
On Tuesday 24 November 2015 17:31:19 Kevin Chadwick wrote:
> > > > > The statement "HTTP is insecure" is wrong and a lie. That's my
> > > > > problem.
> > > > 
> > > > HTTP is insecure and HTTP can't be made secure, it's a fact
> > > > 
> > > > existence of extensions like Firesheep prove it
> > > 
> > > Nonsense, that is likie saying the existence of a virus/rootkit
> > > means
> > > that Operating systems are insecure.
> > 
> > yes, certain versions of operating systems are known to be insecure.
> > Subsequently they got updates released and are no longer vulnerable.
> > 
> > You can't update HTTP to not be insecure. You *can't* fix it.
> 
> You completely miss the point, extensions like firesheep need access
> in the first place like a trojan or local program. Your original
> argument has no bearing on the discussion at all.

you don't understand what firesheep does - it does not require access to 
computer under attack, it requires access to network on which the system 
under attack is

and that is not exactly that hard to arrange if you're on a WiFi in a 
hotel/coffee house/event or on a network in school/library...

it's not 1970's any more, there is no such thing as a "trusted network"*

> p.s. it doesn't need fixing, however https really does from a design
> point of view. Thankfully from a technical fix point of view there are
> a few forks from openssl too such as libressl as well as googles.

you are mixing up completely different topics while missing the elephant 
in the room

just because one implementation has a bug doesn't make the protocol 
itself incorrect

> Also http tunnelled over ssh is much more secure than over SSL, so it
> would make most sense if you would just retract your statement
> entirely.

and GPG is better than S/MIME which in turn is better than plain text 
email

both (S/MIME and HTTP+SSH) are also unusable by the average person 
connecting to average server

HTTPS on the other hand is used by billions


 * - yes there are exceptions with air gapped systems, with cables not 
leaving a shielded room or virtual networks between virtual hosts on a 
single machine. But they are only that - exceptions.
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic

_______________________________________________
dev-security mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security
signature.asc (application/pgp-signature, 819 B)