Re: A proposal

* Mike Belshe wrote:
>As we're all aware, there are about 200 countries on this planet.  Many of
>the governments of these countries are using packet siphoning as a key
>information gathering technique.  It's easy today.  They do this for many
>protocols beyond just HTTP.  But what do they do with this information?  We
>know the answer to this too - they are out to kill their dissidents.
>
>So when we don't protect everything from generic siphoning, we are
>facilitating murders and genocides.  Is this dramatic?  Yeah its dramatic.
> But is it untrue?  No.  I know the counter argument already!  You'll say
>"but we already MITM!", and pretend that MITM is just as easy as siphoning
>cleartext when we know that its not even close to the same thing. TLS does
>make raw siphoning of packets orders of magnitude more expensive and
>difficult to do.  Or you'll say "but DNS is exposed!", as though DNS were
>on the same level as words and phrases that you communicate with other
>people.  Or you'll say, "but SMTP is cleartext", as though we have to
>secure every last possible door if we secure any of them... Sigh.
>
>I am not sure what the next 10 years will bring.  But I am certain it will
>bring many incidents where we'll be able to look back and say, "hmmm... if
>we had put TLS in HTTP by default, that might not have happened."
>
>People don't die because we did put in TLS.  They only die if we don't.

Could you give a couple of examples of critical information carried in
HTTP traffic that would become unavailable to such actors if they were
unable to decipher HTTP traffic? It seems reasonable to assume, for in-
stance, that they would be able through one way or another to find out
which IP address was associated with a given target at specific inter-
vals, and asking a couple of large corporations for all data they have
associated with the addresses during those intervals would likely yield
e.g. account identifiers, which could then be used to obtain even more
data. What could these actors want to know that would not be available
through such methods ten years from now?
-- 
Björn Höhrmann · mailto:bjoern@hoehrmann.de · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

Received on Wednesday, 20 November 2013 00:53:15 UTC