Timeline for Is there any difference between HTTP and HTTPS when using my home / own internet connection
Current License: CC BY-SA 3.0
32 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 3, 2018 at 9:55 | history | edited | I am the Most Stupid Person | CC BY-SA 3.0 |
added 14 characters in body
|
| Aug 28, 2017 at 21:54 | answer | added | JW0914 | timeline score: 1 | |
| Aug 28, 2017 at 7:18 | comment | added | daniel f. | en.m.wikipedia.org/wiki/HTTP_Public_Key_Pinning you can tell browsers to pin public keys by using the proper http headers. It is invisible to the user, the browser does it for you | |
| Aug 28, 2017 at 7:14 | comment | added | Criticizing Israel not allowed | @danielf. Are they doing it to HTTPS sites now and requiring you to install their certificate? | |
| Aug 28, 2017 at 7:12 | comment | added | daniel f. | @immibis and that is why certificate pinning needs to become more widespread | |
| Aug 27, 2017 at 22:50 | comment | added | user541686 | @immibis: Huh, I wasn't aware home ISPs did it, thanks for that. Yeah, I mean it's certainly better to use HTTPS, no doubt about that. | |
| Aug 27, 2017 at 22:43 | comment | added | Criticizing Israel not allowed | @Mehrdad It's home ISPs that do (did?) it. And sometimes the injected ads broke the webpages they were injected into. Even if you are not especially concerned about tampering, the fact they break things when they can is a good reason to use HTTPS. | |
| Aug 27, 2017 at 21:57 | comment | added | user541686 | @immibis: Yeah I'm aware of ads (in another comment I said "maliciously tampering" to account for this, as well as the fact that we're talking about home ISPs, not cell service providers) -- but that's irrelevant, since injecting ads in plain view is quite a far call from secretly forging credentials and silently masquerading as the other party. One is a visible nuisance, the other one is a serious felony. | |
| Aug 27, 2017 at 21:44 | comment | added | Criticizing Israel not allowed | @Mehrdad I mean, you can trust them (you are physically capable of doing so), but you'd be wrong to (they are not trustworthy). Some ISPs are known to inject extra ads for example. | |
| Aug 27, 2017 at 17:00 | comment | added | user119076 | If I'm your network admin I'm pretty sure I can intercept everything. | |
| Aug 27, 2017 at 8:36 | comment | added | user541686 | @immibis: I'd argue you're wrong, because you can trust your ISP not to tamper with traffic, and lack of tampering (not lack of snooping) is all you need to be able to ensure full security. The real trouble is the fact that there are more entities between you and the destination server besides the immediate ISPs. | |
| Aug 27, 2017 at 8:18 | answer | added | Tgr | timeline score: 0 | |
| Aug 27, 2017 at 5:54 | answer | added | Jordan | timeline score: 2 | |
| Aug 27, 2017 at 0:50 | comment | added | Ismael Miguel | Related? security.stackexchange.com/questions/153797/… | |
| Aug 25, 2017 at 15:37 | answer | added | stevegt | timeline score: 6 | |
| Aug 25, 2017 at 13:36 | comment | added | AccountantM | "When I'm using my laptop at home, is there any advantage of using HTTPS over HTTP?" . Yes, the data being sent between you and the server is encrypted, so no one in the middle whoever he is can't see it without breaking the encryption. Plus you are sure that the data you received is from the server you want. | |
| Aug 25, 2017 at 13:29 | comment | added | Doktor J | @jpaugh 's question is highly relevant. If you're talking about using only HTTP to communicate with, say, your home media server's configuration page... well that's not likely going to be an issue unless you have an unsecured Wi-Fi access point or other untrusted points of entry on your home network (note, this could include your ISP-supplied router!). | |
| Aug 24, 2017 at 20:06 | comment | added | Steve B | eff.org/https-everywhere may help to maximize using Https when browsing | |
| Aug 24, 2017 at 18:05 | comment | added | user | Relevant on Webmasters: Force Using SSL on Site now? and What events caused mass migration to HTTPS? and What is the benefit of forcing a site to load over SSL (HTTPS)? and probably a decent chunk of their [https] tag. | |
| Aug 24, 2017 at 16:22 | comment | added | Dubu | @immibis More like "could read your postcards." To read the contents of unencrypted IP traffic you do not even have to pry open some envelope, it's just there in the clear, on their lines and routers. | |
| S Aug 24, 2017 at 15:15 | history | suggested | trinaldi | CC BY-SA 3.0 |
Grammar and formatting
|
| Aug 24, 2017 at 14:39 | review | Suggested edits | |||
| S Aug 24, 2017 at 15:15 | |||||
| Aug 24, 2017 at 9:41 | history | tweeted | twitter.com/StackSecurity/status/900654242058424320 | ||
| Aug 24, 2017 at 9:39 | comment | added | ecc | You don't have a secure pipe to the server, not even from your home. In this day and age, everyone is trying to scoop into your requests, even your ISPs. And your connection can be hopping from places far less trustowrthy than your ISP, too. | |
| Aug 24, 2017 at 8:21 | comment | added | jpaugh | BTW, if you're using equipment supplied by your employer, they can (and probably do) monitor SSL traffic. Essentially, they can spoof the certificates for every website, as long as they install their spoofed certs (or spoofing CA) to your OS's trusted certificate store. | |
| Aug 24, 2017 at 8:13 | comment | added | jpaugh | Are you talking about using a website on the same computer as your browser, one on another computer on your network, or one on the internet at large? Most answers will be predicated on your choice of network. | |
| Aug 24, 2017 at 7:48 | answer | added | TriloByte | timeline score: 6 | |
| Aug 24, 2017 at 7:37 | comment | added | Criticizing Israel not allowed | In this day and age you can't trust your ISP. Your ISP can see everything you send to a server because you sent it to them - kinda like how the post office could read your letters, if they wanted. | |
| Aug 24, 2017 at 5:34 | vote | accept | I am the Most Stupid Person | ||
| Aug 24, 2017 at 4:17 | answer | added | Mike Ounsworth | timeline score: 120 | |
| Aug 24, 2017 at 3:42 | review | First posts | |||
| Aug 24, 2017 at 5:08 | |||||
| Aug 24, 2017 at 3:41 | history | asked | I am the Most Stupid Person | CC BY-SA 3.0 |