Date: Sun, 3 Aug 2014 11:57:00 +0400 From: gremlin@...mlin.ru To: oss-security@...ts.openwall.com Subject: Re: CVE Request: Enforce use of HTTPS for MathJax in IPython On 02-Aug-2014 20:07:23 -0600, Kurt Seifried wrote: >>> Enforcing HTTPS for the whole site is even more stupid: normally >>> only user-specific data (login procedure, personal settings for >>> registered users, etc) should be forced to go through HTTPS; >>> everything else should normally be left up to the users' wish. >> This is incredibly wrong. First off if only your login procedures, >> personal > +1. If you commit to encrypting the entire site then you can do > things like [...] Simple question: who do you trust more - your ISP or site owner? Or should I ask whether you trush either of them? Hint: ISPs may be subjected to SORM-2 (been there, seen that, no t-shirt this time), Jindun Gongcheng, or other pretty things. Site owners may be interested in tracking their users' activity (that's why I prefer browsing online shops anonymously, without logging in). Other people may try to eavesdrop (or even intercept) connections from users to servers. > It's not about the users wish. It's about the site's wish. The > site is providing the service, the site provides the TOS/AUP/etc. > The site may choose optionally to leave it up to the user, but > this is a VERY bad idea. When people want to make their systems secure, they use client-side certificates. When people want to make their systems public, they normally don't care of who access them and don't track their users. When a site allows anonymous access, that may be performed via HTTP. Authenticated (over HTTPS) users may (and normally should) work via HTTPS, but forcing all users to use HTTPS is "a VERY bad idea" // (q) Kurt Seifried, 2014-08-03 -- Alexey V. Vissarionov aka Gremlin from Kremlin <gremlin ðòé gremlin ôþë ru> GPG: 8832FE9FA791F7968AC96E4E909DAC45EF3B1FA8 @ hkp://keys.gnupg.net
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ