[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20140803075700.GC29958@gremlin.ru>
Date: Sun, 3 Aug 2014 11:57:00 +0400
From: gremlin@...mlin.ru
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request: Enforce use of HTTPS for MathJax in IPython
On 02-Aug-2014 20:07:23 -0600, Kurt Seifried wrote:
>>> Enforcing HTTPS for the whole site is even more stupid: normally
>>> only user-specific data (login procedure, personal settings for
>>> registered users, etc) should be forced to go through HTTPS;
>>> everything else should normally be left up to the users' wish.
>> This is incredibly wrong. First off if only your login procedures,
>> personal
> +1. If you commit to encrypting the entire site then you can do
> things like [...]
Simple question: who do you trust more - your ISP or site owner?
Or should I ask whether you trush either of them?
Hint: ISPs may be subjected to SORM-2 (been there, seen that, no
t-shirt this time), Jindun Gongcheng, or other pretty things. Site
owners may be interested in tracking their users' activity (that's
why I prefer browsing online shops anonymously, without logging in).
Other people may try to eavesdrop (or even intercept) connections
from users to servers.
> It's not about the users wish. It's about the site's wish. The
> site is providing the service, the site provides the TOS/AUP/etc.
> The site may choose optionally to leave it up to the user, but
> this is a VERY bad idea.
When people want to make their systems secure, they use client-side
certificates. When people want to make their systems public, they
normally don't care of who access them and don't track their users.
When a site allows anonymous access, that may be performed via HTTP.
Authenticated (over HTTPS) users may (and normally should) work via
HTTPS, but forcing all users to use HTTPS is "a VERY bad idea"
// (q) Kurt Seifried, 2014-08-03
--
Alexey V. Vissarionov aka Gremlin from Kremlin <gremlin ПРИ gremlin ТЧК ru>
GPG: 8832FE9FA791F7968AC96E4E909DAC45EF3B1FA8 @ hkp://keys.gnupg.net
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
