[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <etPan.53de6125.66334873.d5d9@Thor.local>
Date: Sun, 3 Aug 2014 12:19:49 -0400
From: Donald Stufft <donald@...fft.io>
To: gremlin@...mlin.ru, oss-security@...ts.openwall.com
Subject: Re: CVE Request: Enforce use of HTTPS for
MathJax in IPython
On August 3, 2014 at 3:57:58 AM, gremlin@...mlin.ru (gremlin@...mlin.ru) wrote:
> On 02-Aug-2014 20:07:23 -0600, Kurt Seifried wrote:
>
> >>> Enforcing HTTPS for the whole site is even more stupid: normally
> >>> only user-specific data (login procedure, personal settings for
> >>> registered users, etc) should be forced to go through HTTPS;
> >>> everything else should normally be left up to the users' wish.
> >> This is incredibly wrong. First off if only your login procedures,
> >> personal
> > +1. If you commit to encrypting the entire site then you can do
> > things like [...]
>
> Simple question: who do you trust more - your ISP or site owner?
> Or should I ask whether you trush either of them?
>
> Hint: ISPs may be subjected to SORM-2 (been there, seen that, no
> t-shirt this time), Jindun Gongcheng, or other pretty things. Site
> owners may be interested in tracking their users' activity (that's
> why I prefer browsing online shops anonymously, without logging in).
> Other people may try to eavesdrop (or even intercept) connections
> from users to servers.
This is a nonsensical point too. I have to trust the site owners
to some degree. To what degree broadly depends on what the site
itself does however at the very least they’ll be able to see what
account I’m attempting to use.
With enforced HTTPS and HSTS I don’t have to trust my ISP.
>
> > It's not about the users wish. It's about the site's wish. The
> > site is providing the service, the site provides the TOS/AUP/etc.
> > The site may choose optionally to leave it up to the user, but
> > this is a VERY bad idea.
>
> When people want to make their systems secure, they use client-side
> certificates. When people want to make their systems public, they
> normally don't care of who access them and don't track their users.
>
> When a site allows anonymous access, that may be performed via HTTP.
> Authenticated (over HTTPS) users may (and normally should) work via
> HTTPS, but forcing all users to use HTTPS is "a VERY bad idea"
> // (q) Kurt Seifried, 2014-08-03
>
What is the downside to forcing HTTPS.
--
Donald Stufft
PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
