Re: [PLUG] news

[Thomas Delrue via plug <plug@lists.phillylinux.org>]

I respectfully disagree...
Note: the 'you' is the proverbial 'you', not you individually.

On 8/10/20 4:14 PM, brent timothy saner via plug wrote:
> On 8/10/20 3:58 PM, Michael Lazin via plug wrote:
>> I think the interesting point about the HTTP smuggling article that you
>> reference is it still works.  Google rankings are negatively impacted if
>> you don't have an SSL certificate, and we have plugins like HTTPS
>> everywhere, which force HTTPS on the client-side, and yet still HTTP
>> persists despite it not being secure.  There was a time when purchasing
>> a certificate was cost-prohibitive, but many web hosts now include a
>> cert with hosting and there are free SSL cert providers.  I think this
>> is a sign that providers should start forcing https connections on the
>> server-side.  I know this is controversial because you want the maximum
>> amount of people to view your website, and you don't want to lock out
>> people with old hardware/software. Still, maybe it would be wise for the
>> Internet community to start doing this for security reasons and not just
>> google rankings. 
>>
>> Michael Lazin
>>
>> to gar auto estin noein te kai ennai
> 
> "Encrypt everything all the time" is generally not a good stance to take.

I take issue with this and am of the opposite opinion: I think
everything should be encrypted by default.

> Encrypt things that should be, like sensitive data? Absolutely. But
> unquestioned enforced encryption is a generally bad idea because
> encryption requires trust, which leads to either needing to verify every
> single site or trusting a central authority. Which can then be a single
> point of failure, technologically or politically.

So does not-encryption. In fact, that requires more trust, it requires
trust with everyone in the entire universe, trust that they won't abuse
the information they glean from looking over my shoulder.
Sure, my trust might be misplaced, but even if it is, the compromising
is limited in my encrypted communications with you. That misuse of trust
can be compartmentalized.

Note that I'm not talking about HTTPS and the problems around the certs,
just about the premise that "only sensitive things need encryption".

The thing is, I don't have any business looking at your comms, and you
don't have any business looking at mine. With encryption being so
'cheap', why wouldn't I encrypt it? Why wouldn't I put something in
place to make your life just a little shittier if you want to pry into
my comms?

> You don't need to encrypt a website that's purely informational, for

Of course I do. Because you (as non-party in the conversation between me
and the purely informational site) have no business looking at what I'm
talking about with that server. That server might even be hosting
multiple different sites, and in that case, using ESNI, you don't even
know which site on that server I'm talking to. Because you have no
business knowing that.

What is 'informational' to you, is deviant to another, and the decision
is not yours to make when it comes to what /I/ find 'sensitive' and what
I don't.
What is innocent today, may be illegal tomorrow.

On top of this all, when you encrypt it all, you're making it harder for
anyone to target everyone... just think about that for a while.

> instance, unless it contains that sensitive data. It can of course help
> with *ensuring integrity* of that data, but it's generally not without
> its complications and a whole new can of worms.
> 
> This proposal also complicates (needlessly, in many cases)
> reverse-proxying and load balancing, it breaks numerous "upper"
> protocols that rely on HTTP as a transport (but don't account for TLS
> tunnelling), it breaks XSD validation, it complicates (if not breaks)
> NATted LAN HTTP communication, and makes packet tracing/packet dumps
> utterly useless for debugging. Just to name a few off the top of my head.
> 
> A good example of this is the DoH hype. Now Comcast, with its arguably
> quite questionable decisions regarding business ethics, is doing this:

Don't get me started on DoH... I'm not a fan to say the least.

Attachment: signature.asc
Description: OpenPGP digital signature

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug