HTTPS is broken by content delivery networks who terminate SSL connections.
HTTPS is broken by content delivery networks who terminate SSL connections. HTTPS Everywhere makes the problem worse, by increasing load for static pages and breaking caches, forcing sites to use a content delivery network. Take a look at that HTTPS certificate that you think means you're talking to the site of your choice. If it says "cloudflare.com", "incapsula.com", "edgecastcdn.com", "palmwebservices.com", "cdnetworks.net", there is a man in the middle of your HTTPS connection. This is the case for at least 38,000 sites we know about. There are probably more. (The list: http://john-nagle.github.io/certscan/whoamitalkingto04.pdf ) HTTPS Everywhere was well-intentioned, but the people behind it didn't realize that high-volume use of HTTPS forced less secure use of HTTPS. That's why it's a form of security theater.
Posted by Animats on Jan 21, 2015, 5:05 AM
Tags
Related issues
- Huh, this is not my experience.
- For some reason an Azure outage does not faze me in the same way that an AWS outage does.
- The triplet of wind, pole, dragon appears multiple times in the same order, so is possibly a single phrase that has been broken up into t...
- Option to skip refreshing resource instances whose configuration hasn't changed since the last apply
- [YouTube] Unable to extract uploader id
- Add ability to prioritize GitHub Action runners
Raise real-world problems, find people facing the same issue, and discuss solutions.8,000 issues0 comments
reliability (E-commerce)
Huh, this is not my experience.
For some reason an Azure outage does not faze me in the same way that an AWS outage does.
The triplet of wind, pole, dragon appears multiple times in the same order, so is possibly a single phrase that has been broken up into t...
Option to skip refreshing resource instances whose configuration hasn't changed since the last apply
[YouTube] Unable to extract uploader id
Add ability to prioritize GitHub Action runners
Microsoft Flight Simulator (2020) (1250410)
Codegen collaboration with Apollo Codegen and GraphQL Code Generator
HTTPS is broken by content delivery networks who terminate SSL connections.
HTTPS is broken by content delivery networks who terminate SSL connections. HTTPS Everywhere makes the problem worse, by increasing load for static pages and breaking caches, forcing sites to use a content delivery network. Take a look at that HTTPS certificate that you think means you're talking to the site of your choice. If it says "cloudflare.com", "incapsula.com", "edgecastcdn.com", "palmwebservices.com", "cdnetworks.net", there is a man in the middle of your HTTPS connection. This is the case for at least 38,000 sites we know about. There are probably more. (The list: http://john-nagle.github.io/certscan/whoamitalkingto04.pdf ) HTTPS Everywhere was well-intentioned, but the people behind it didn't realize that high-volume use of HTTPS forced less secure use of HTTPS. That's why it's a form of security theater.
Comments (0)
No comments yet. Start the discussion.