Re: HTTP is just fine

Hubert Kario <[email protected]> Wed, 25 Nov 2015 14:52:12 +0100
Newsgroups	gmane.comp.mozilla.security
Message-ID	<[email protected]>
On Wednesday 25 November 2015 12:31:48 Kevin Chadwick wrote:
> > What if I tell you that your ISP is currently intercepting
> > plain HTTP Amazon traffic from all its subscribers so that they can
> > build up an advertisement profile of you. They do that for all
> > their subscribers and they sell that data to interested parties.
> > Big data, big money. Only possible with plain HTTP.
> > 
> > I made that up. But it may be true. Who knows. The data is insecure
> > so simply you do not know who is capturing it and what is happening
> > with it. Assume the worst.
> > 
> > Maybe you don't care about your blog being secure. What kind of info
> > is on there anyway, it is all static content. Does not have to  be
> > secure right? Well, maybe I live in china and I am reading an
> > article about TOR proxies that you wrote. Technically there is no
> > reason the server is secure. But the content is dangerous for me to
> > read in China! And since it was captured by the state hosted proxy
> > I can now expect a visit from local police, asking me why I am
> > reading about TOR.
> > 
> > That is the bigger picture. Look beyond local networks and bugs in
> > OpenSSL. It is just not about that.
> 
> however my ISP is Zen who I trust not
> to do so.

https://en.wikipedia.org/wiki/IP_hijacking

> after all a compromise elsewhere could lead to a
> compromises of all https traffic on an end node anyway.

you really have no idea how TLS works and what it provides, now do you?
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic

_______________________________________________
dev-security mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security
signature.asc (application/pgp-signature, 819 B)