369 reputation
112
bio website cnst.su
location San Jose, CA
age
visits member for 1 year, 7 months
seen yesterday

Jul
23
awarded  Popular Question
Jul
21
comment How can I enable opportunistic encryption for my web-site?
Because certificates are controlled by the CA cartels with prohibitive pricing for multi-domain certs; because self-signed certs would create too many nuisance warnings all over (whereas http is warning-free); because the https certs have to be renewed every X months; because not everyone supports SNI, and people linking to my site through the https:// address scheme would be making my site unavailable for lots of users (e.g. Android 2.3) and bots. As my non-profit sites don't require authentication, I will never implement https:// due to the shortcomings as above.
Jul
7
awarded  Tumbleweed
Jul
2
awarded  Curious
Jul
1
comment Why self-signed https is less trustworthy than unencrypted http?
I'm not sure what you meant to say, but I fail to see how my observation is incorrect. The user experience with self-signed certificates is incorrect. Luckily, it looks like IETF is finally taking some interest in this problem, as per tools.ietf.org/html/rfc7258 and security.stackexchange.com/questions/62094/…
Jun
30
asked Is opportunistic encryption support optional for HTTP/2?
Jun
30
comment Why self-signed https is less trustworthy than unencrypted http?
So, let them move — not every attacker is capable of moving, say, western governments want to avoid detection. Even though we all know that we are probably being mass-surveilled, I'm pretty sure that an active first-hand confirmation of such mass-surveillance would still come as a shock to many. Basically, in your whole viewpoint, you disregard STARTTLS in SMTP as being one bit useful, and also disregard RFC 7258 with it, too. Your ideas might be the majority in this profit-driven world, but my non-profit freedom viewpoint is luckily not alone: news.ycombinator.com/item?id=7963228
Jun
30
comment Why self-signed https is less trustworthy than unencrypted http?
The fact that self-signed HTTPS is worse than plain HTTP was an observation, not a question. Your hypothesis that it is better is not supported by the user experience of the existing implementations.
Jun
30
revised opportunistic-encryption wiki description
added 224 characters in body
Jun
30
revised opportunistic-encryption wiki excerpt
added 111 characters in body
Jun
30
comment Why self-signed https is less trustworthy than unencrypted http?
I've created a follow up question based on your mention of the IETF drafts for opportunistic encryption in HTTP -- security.stackexchange.com/questions/62094/….
Jun
30
wiki created opportunistic-encryption description
Jun
30
wiki created opportunistic-encryption excerpt
Jun
30
suggested suggested edit on opportunistic-encryption tag wiki
Jun
30
suggested suggested edit on opportunistic-encryption tag wiki excerpt
Jun
30
asked How can I enable opportunistic encryption for my web-site?
Jun
29
comment Why self-signed https is less trustworthy than unencrypted http?
Your httpe suggestion is misguided, because, just like the https scheme, it suffer from lack of backwards compatibility, so, I would never adopt anything like that. But thank you very much for finding the IETF drafts, for exactly the things I'm looking for! Glad we aren't left alone, after all, and someone's already working on these improvements for avoiding passive surveillance without having to deal with the certificate cartels!
Jun
29
comment Why self-signed https is less trustworthy than unencrypted http?
You keep talking about all these theoretical things which, as I've outlined in my question, and which you did not attempt to refute, don't actually happen in practice all that often. So, no, I don't use any PKI, yet none of my email exchanges with other similarly situated parties gets sniffed (since it's all encrypted, so, passive sniffing is useless), yet all my http traffic is available to the authorities. We don't need no PKI. I do care about privacy, but I also care about freedom more than I care about privacy, and depending on the Certificate Authority cartel isn't what I call freedom.
Jun
29
comment Why self-signed https is less trustworthy than unencrypted http?
That's kinda exactly my point -- with mail, TLS gets used in practice all the time, yet stuff is guaranteed to not fail if TLS is not available, so, it is theoretically subject to the active attacks, but in practice, it's at least immune from passive ones. Why HTTP is still not immune to passive attacks?
Jun
29
comment Why self-signed https is less trustworthy than unencrypted http?
But it's not a problem with STARTTLS in SMTP; why is it a problem with HTTP?