zlacker

>>pimter+(OP)
im gonna remove even https from my server. gotta go http in protest against this nonsense.

i'm already pissed off that firefox warns people that my site is unsafe for them when i dont even stick a cookie on them and yet provide useful Free software.

>>uwagar+k9
That's like pissing in your own pants to try and keep warm and you weren't cold in the first place.

>>Avaman+ha
i mean if i'm not tracking the user at all, why should i use https?

>>uwagar+Lx
To prevent isp or mitm injection... ISPs have a history of injecting ads into http connections.

>>helloj+W81
They're right though. The browser should have had a mode that ensures integrity without privacy (it's trivial; use PKI to sign the content, send the signature as a header, client validates the signature, and you have integrity over plaintext; or just a form of HSTS, if you don't need PKI, because if HSTS is good enough for certs, it's good enough for anything ELSE, right?). There could be protocol extensions that support clients only loading dynamic or identifying content for specific requests. All sorts of features could allow basic plaintext connections with public content to be as secure as HTTPS.

But the browser oligarchy doesn't want to allow that. They want to force everything to be private, which has caused tons of issues on the internet. And actually, it has strengthened the oligarchy, by forcing us to use private services (such as DNS-over-HTTPS, VPNs, CDNs, etc) which locks more of the internet into the control of a tiny handful of super powerful companies. To the point where if one of them decides to change something, it ripples across the entire internet, and everyone is forced to adopt it or break everything.

Crazier still... HTTPS isn't even that secure! Every year there are examples of valid certs being created for MITM. There are multiple vulns that work at any time. Mitigations that are optional and only a tiny fraction of the web use. And cert expiration, HSTS, and other issues still take down sites accidentally. But they force everyone to use it anyway!

>>0xbadc+sa1
> The browser should have had a mode that ensures integrity without privacy (it's trivial; use PKI to sign the content, send the signature as a header, client validates the signature, and you have integrity over plaintext; or just a form of HSTS, if you don't need PKI, because if HSTS is good enough for certs, it's good enough for anything ELSE, right?).

Can you help me understand this please? Without a trusted CA, anyone can mitm by generating their own public/private keys for the user to pretend to be the destination server. They can then sit in the middle and view/alter traffic as it's passed back and forth between the true destination.

How does your proposal prevent that?