Re: Proposal: Marking HTTP As Non-Secure
Victor Costan <[email protected]> Tue, 2 Feb 2016 09:41:53 -0500
| Newsgroups | gmane.comp.web.chromium.security.devel,gmane.comp.mozilla.security |
|---|---|
| Message-ID | <CALFbkGUAcNVWg-wK7DmPCHLeE9huAcNn9QPmSRV-9pf1w2Fgrg@mail.gmail.com> |
On Tue, Feb 2, 2016 at 10:43 AM, Kevin Chadwick <[email protected]> wrote: > If however you mainly do research of public domain content that has no > need to be encrypted or I expect most things on the internet have no > need to be encrypted then it seems more important to say to users: > > Hey as this sites admin I have decided that this communication needs > to be secure therefore you should check the domain name is correct. > Equating HTTPS to encryption, and therefore privacy guarantees, is incorrect. HTTPS also gives you integrity guarantees. My site contents may be public, but I'd prefer to be assured that users get exactly what I wrote, without any additions or edits from other parties on the network. For an example why these concerns are legitimate, see http://arstechnica.com/tech-policy/2014/09/why-comcasts-javascript-ad-injections-threaten-security-net-neutrality/ Victor -- You received this message because you are subscribed to the Google Groups "Security-dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]