W3C home > Mailing lists > Public > www-tag@w3.org > December 2014

RE: Draft finding - "Transitioning the Web to HTTPS"

From: Domenic Denicola <d@domenic.me>
Date: Wed, 10 Dec 2014 17:31:57 +0000
To: Melvin Carvalho <melvincarvalho@gmail.com>
CC: Marc Fawzi <marc.fawzi@gmail.com>, "Eric J. Bowman" <eric@bisonsystems.net>, Chris Palmer <palmer@google.com>, Mark Nottingham <mnot@mnot.net>, "www-tag@w3.org List" <www-tag@w3.org>
Message-ID: <CY1PR0501MB1369D57661D60886BC4E6FF8DF620@CY1PR0501MB1369.namprd05.prod.outlook.com> 
From: Melvin Carvalho [mailto:melvincarvalho@gmail.com] 

> Firstly, HTTP isnt always insecure, it can be, but is not always

HTTP is always insecure by definition. The insecure transport is not always being *attacked*, but you have literally no way of knowing whether you're being attacked or not, so for all practical purposes you must always assume an attack.

> Some of the functions in web crypto such as SHA256, or even AES, are useful over HTTP

They are not useful if the network attacker overrides `window.crypto.subtle.*` to replace your SHA256 funcitonality with the identity function, or with a function that does a pass-through after sending the data to a remote server, or...
Received on Wednesday, 10 December 2014 17:32:32 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 22:57:08 UTC