Slashdot Mirror

← Back to Stories (view on slashdot.org)

Safari Tests 'Not Secure' Warning For Unencrypted Websites (cnet.com)

Posted by BeauHD on from the heads-up dept.

Similar to Chrome, Apple's Safari browser is testing a warning system for when users visit websites that aren't protected by HTTPS encryption. "The feature for now is only in Safari Technology Preview 70, a version of the web browser Apple uses to test technology it typically brings to the ordinary version of Safari," reports CNET. From the report: Apple didn't immediately respond to a request for comment on its plans for bringing the warning to mainstream Safari. Apple's browser does warn you already if you have an insecure connection to a very sensitive website for typing in passwords or credit card numbers.

66 comments

  1. Isn't this a waste? by Anonymous Coward · · Score: 0

    Do we really need SSL on everything?

    1. Re:Isn't this a waste? by Aighearach · · Score: 2

      Do we really need SSL on everything?

      The reality is that you need SSL just to prevent content from being transparently altered en-route; it is not only for secret content, but just for knowing what the content actually was!

      Sad, but true.

    2. Re:Isn't this a waste? by Anonymous Coward · · Score: 2, Insightful

      Do we really need SSL on everything?

      Yes. Only securing "sensitive" traffic makes it trivially easy to identify "sensitive" traffic.

      Also, Yes! What what you consider non-sensitive information may, in fact, be useful to a malicious actor listening in on the wire.

      Do you really want your ISP any one else in the transit path between you and Google knowing what search terms you enter? That's between you and Google. Do you want your ISP censoring your Internet? Modifying pages as they come back to remove "bad" words?

      SSL also helps to prevent modification of data in transit. The most easy example of this is inserting malicious javascript in a page as it passes through one of the many hops enroute to you. With SSL you have some confidence (if you trust the CA, for example) that you are talking directly to the remote host you think you are and that nobody can insert malicious code or modify the data on its way to you without your client noticing.

    3. Re:Isn't this a waste? by Cmdln+Daco · · Score: 1

      Google needs SSL, because they control the endpoints, and don't need any of 'their' info leaking out to anybody else.

      Apple is kinda keen on that, too. Not as ravenous as Google with people in general, but they have a strong herding instinct for their
      'sheep.'

    4. Re:Isn't this a waste? by Strider- · · Score: 3, Interesting

      So what you’re saying is that we need content validation without full encryption for most things. This is how windows update (and I think apple update). Hashes of the packages are transferred securely, while the bulk data is in the clear. This allows the data to be verified, while still permitting caching to work.

      --
      ...si hoc legere nimium eruditionis habes...
    5. Re:Isn't this a waste? by bug_hunter · · Score: 1

      So you believe Apple joining on the SSL everywhere bandwagon is because... they're actively working against privacy?

      --
      It's turtles all the way down.
    6. Re: Isn't this a waste? by Anonymous Coward · · Score: 0

      Other browsers use the lovely color red for the address window.

    7. Re:Isn't this a waste? by brantondaveperson · · Score: 1

      I was about to complain about local devices, like my NAS, before I discovered that I can set up a self-signed cert for its local domain in a few clicks. Given how many people have the password to by wifi (pretty much anyone who ever visited the house), this is probably a good thing.

    8. Re:Isn't this a waste? by Shaitan · · Score: 1

      This ^

    9. Re:Isn't this a waste? by ls671 · · Score: 1

      Signing != encrypting! Granted, SSL might make it harder to alter content but it is weak compared to signing the content.

      What you are saying is like saying that since you downloaded a piece of software through SSL, you are safe enough and you don't need to check the signature.

      Note that signing doesn't require encryption at all.

      Some corporate environments and maybe even some countries could force you to have their certs trusted. They can then alter content at will.

      So in the end, you do not need encryption at all to make sure the content hasn't been altered. You only need signing. Furthermore, encryption is a weak way to guarantee that content hasn't been altered compared to signing.

      See here if you weren't already aware of that fact:
      https://users.ece.cmu.edu/~adr...

      --
      Everything I write is lies, read between the lines.
    10. Re:Isn't this a waste? by Anonymous Coward · · Score: 0

      The reality is that you need SSL just to prevent content from being transparently altered en-route; [...]

      CenturyLink customers tend to have that problem.

    11. Re:Isn't this a waste? by Anonymous Coward · · Score: 0

      Yes. Only securing "sensitive" traffic makes it trivially easy to identify "sensitive" traffic.

      Easier than SNI or PKI ident?

      Also, Yes! What what you consider non-sensitive information may, in fact, be useful to a malicious actor listening in on the wire.

      Lots of things may in fact be useful. Simply arguing something could happen therefore something must be done is unwarranted. To make an informed decision risk and costs must be characterized and weighed accordingly.

      There are a number of downsides and risks to "securing everything" under the current system.

      1. Need for more permission to speak on the web. I need a DNS name because IP literals can't be secured. I need a TLS certificate. Both are subject to scrutiny and revocation by unfriendly adversaries who now have leverage over me and can exercise it to shut me up.

      2. The system is impossibly fucked up. Bad enough the security of everything rests on literally hundreds of planet scale overlapping trust providers (some state run) being absolutely trustworthy and infallible which they most certainly are not. The more you secure the more impossible a burden is placed on trust providers as value of successful usurpation approaches infinity. The more you secure the more each and every CAs starts to resemble storing all the gold in Fort Knox in a Wallmart parking lot guarded only by Wallmart employees wielding mops and brooms.

      System desperately needs to be re-architected. DV needs to be a standard basic function of registrar/normal domain ownership. Localized off-ramps are necessary to reduce benefit of success and increase risk of being discovered.. PKI should only ever be employed for initial service discovery.

      As it is now things are so ridiculous I can see cases where the illusion of a secure trustworthy system is actually worse than a user believing a channel is insecure and acting accordingly.

      Do you really want your ISP any one else in the transit path between you and Google knowing what search terms you enter?

      Google search terms especially when using autocomplete feature can be defeated by exploiting timing and length analysis. Access to most publically available resources can be similarly disambiguated using these same side channels even though URLs are encrypted.

      SSL also helps to prevent modification of data in transit. The most easy example of this is inserting malicious javascript in a page as it passes through one of the many hops enroute to you. With SSL you have some confidence (if you trust the CA, for example) that you are talking directly to the remote host you think you are and that nobody can insert malicious code or modify the data on its way to you without your client noticing.

      Right now what's inserting malicious codes are trackers, ad networks and click bait.

      This isn't to suggest SSL isn't worth deploying or that it does not offer real benefit. It just doesn't solve very much and never has. It's a bit like patching all of the security bugs in all of the worlds software overnight. Ok great... you just stopped at best 10% of the problem while the remaining 90% continues unimpeded.

    12. Re:Isn't this a waste? by Aighearach · · Score: 1

      Nope. More standards is not what we need.

      The problem is already solved, by existing deployed layers.

      Transparent caching by third parties is a happy idea with flowers and chirping birds, but in practice you gotta wear a condom, er, something something TLS.

    13. Re:Isn't this a waste? by spire3661 · · Score: 1

      NO HELL FUCKING NO. I should NEVER need a third party's permission to pop up a website. Fuck you and authoritarians like you. The web should always be able to transmit in the clear. Dont co-opt freedom for your illusion of safety.

      --
      Good-bye
    14. Re:Isn't this a waste? by Cmdln+Daco · · Score: 1

      So you believe that Apple doesn't monitor your connection to the endpoints they control?

  2. Shared server hosting by HatofPig · · Score: 1

    I've pre-paid for a few years on a shared-hosting plan. Since I don't have a dedicated IP address, that means my little blog doesn't have an SSL certificate. I've got 2-factor authentication turned on, so I'm not super-worried about credentials being intercepted... is there anything else I really need to worry about?

    --
    Silicon & Charybdis McLuhan Kildall Papert Kay
    1. Re:Shared server hosting by Anonymous Coward · · Score: 0

      You don't need a dedicated IP for an SSL certificate. Most shared-hosting providers, make it extremely easy to get and install an SSL

    2. Re:Shared server hosting by Anonymous Coward · · Score: 0

      if you don't collect data from site visitors (e.g. contact form), block your admin login page via additional methods (e.g. via htaccess restrictions, htpasswd, tfa, etc) and aren't publishing 'sensitive' materials your visitors would rather not be snooped-on while reading (e.g. political, controversial, etc).. nah, you're good.

      but, you might still be able to get certificate for your domain (even free ones via lets encrypt project) on an ip address that is not exclusive to it. reasonably recent browsers and server software support tls-sni. ask your host if it is supported.

    3. Re: Shared server hosting by Anonymous Coward · · Score: 0

      Why the fuck would you need a dedicated IP for a TLS cert? Idiot.

    4. Re: Shared server hosting by Anonymous Coward · · Score: 0

      Why the fuck would you need a dedicated IP for a TLS cert? Idiot.

      On old server software, you did need a dedicated IP address.
      While that is no longer the case (unless the server is outdated), you don't have to be an asshole.

    5. Re: Shared server hosting by Anonymous Coward · · Score: 0

      Have they fixed this problem? As I recall, the httpd would have to furnish the certificate before the client even sent the Host header. The fix is simple but non-backwards-incompatible. Did they finally just give in and make the breaking change or did somebody figure out a kludge?

  3. Re:I hate /. bullies like ZIP & c6gunner... ap by Anonymous Coward · · Score: 0

    This is some great performance art. It almost reaches GNAA level.

  4. Re:I hate /. bullies like ZIP & c6gunner... ap by Anonymous Coward · · Score: 0

    Classic seeing ZIP \ Zach squirm unable to back his bs eating his words foot in his mouth ramming them down with a bitter taste of SELF-defeat his big mouth bit off more than it could chew impersonating apk, attacking him and failing hugely https://tech.slashdot.org/comm... and saying he is a better programmer but with nothing to show for himself. ZIP is on the receiving end of his big mouth. Poetic justice. What goes around comes around and now Zach's on the receiving end getting what he dished out and can't take eating crow and his words he can't back up.

  5. Self Signed by ewibble · · Score: 2

    I don't see why a self signed certificate gets a warning, but http doesn't it is no less secure. An Icon saying it is less secure should be enough (say you may not be going to the site you expect). It is really annoying that you have to pay someone a recurring fee just to add a little security. Even worse for routers that don't have a DNS entry, you have to start managing your own certificates.

    1. Re:Self Signed by Anonymous Coward · · Score: 0

      I don't see why a self signed certificate gets a warning, but http doesn't it is no less secure. An Icon saying it is less secure should be enough (say you may not be going to the site you expect). It is really annoying that you have to pay someone a recurring fee just to add a little security. Even worse for routers that don't have a DNS entry, you have to start managing your own certificates.

      1. Plain HTTP shows the "not secure" icon on newer versions of Chrome and Firefox.

      2. Let's Encrypt is free:

      * https://en.wikipedia.org/wiki/Let%27s_Encrypt

      3. I would love for self-signed certs to be used via RFC 2817's HTTP Upgrade on port 80 for opportunistic encryption (even if they still appear as "not secure"):

      * https://en.wikipedia.org/wiki/HTTP/1.1_Upgrade_header
      * https://en.wikipedia.org/wiki/Opportunistic_encryption

    2. Re:Self Signed by thegarbz · · Score: 1

      It is really annoying that you have to pay someone a recurring fee just to add a little security

      You don't. Either get a free certificate, or add your own self-signed root certificate to the trusted store in all your devices and you won't get a warning again.

      Certificates serve for more than encryption. They also serve for identification. This is precisely why self-signed certificates get a warning as it breaks one of the two fundamental points of security:
      1. You know who you are talking to.
      2. You know no one else is listening.

      But in principle I agree, unencrypted information should be called out, but encrypted information should either meet the requirements or present an error message to the user.

    3. Re:Self Signed by AmiMoJo · · Score: 1

      Let's Encrypt offers free certs. You can install your own trusted root cert on your own machines for stuff like routers.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
  6. Coming Soon: by Anonymous Coward · · Score: 0

    Coming soon to a device near you:

    - Attempt to access an Unencrypted / Self-Signed site? 452: Unavailable for Browser Developer's Personal Belief Reasons. (Extended Info: The request was valid, but the browser's developers have refused to provide support for it.)

    - Bypass 452? 453: ISP Bundle Upgrade Required. (Extended Info: The request was valid, but your ISP has refused to carry the packets because you have not subscribed to the service tier the site belongs to. Contact your ISP for more information.)

    For your protection of course. You wouldn't want to access a bad site now would you? Let us protect you from it. After all we know what's best for you.

    1. Re:Coming Soon: by Rockoon · · Score: 1

      +1 Well done sir.

      --
      "His name was James Damore."
  7. How easy to add exception on non-PC clients? by tepples · · Score: 1

    I was about to complain about local devices, like my NAS, before I discovered that I can set up a self-signed cert for its local domain in a few clicks.

    How easy is it to add an exception on your mobile and set-top devices in order to use a self-signed certificate? I seem to remember reading that some game consoles and streaming boxes didn't allow clicking through the unknown issuer exception interstitial.

  8. Why not signing-only? by tepples · · Score: 1

    SSL also helps to prevent modification of data in transit.

    So would a signing-only cipher suite. Signing-only would also have the advantage, as Strider- points out, of allowing an ISP to run a caching proxy for its subscribers to use.

    1. Re: Why not signing-only? by Anonymous Coward · · Score: 0

      That wouldn't protect from replay attacks. How do you make sure a malicious actor will not serve the old content on purpose, like a piece of buggy javascript code? You could say the browser should check the expiration date, but a lot of current webpages serve content with expiration date in the past (for example PHP documentation advises such practice - you can argue it's bad, but that's how it is)

  9. Server Name Indication by tepples · · Score: 1

    Have they fixed this problem? As I recall, the httpd would have to furnish the certificate before the client even sent the Host header.

    That's why the client sends the hostname in cleartext as part of the ClientHello message when it opens a connection. Firefox, Edge, Chrome, and Safari all send Server Name Indication (SNI) in the TLS handshake, as does Internet Explorer on all supported Windows operating systems. The last major web browsers not to support SNI were Internet Explorer on Windows XP (whose extended support ended four and a half years ago) and Android Browser on Android 2.x. Does your site get a lot of page views from those ancient, unsupported browsers?

    1. Re:Server Name Indication by Anonymous Coward · · Score: 0

      Nice. Didn't realize the TLS hello was extensible. Beautiful fix.

  10. False sense of security by tepples · · Score: 1

    I don't see why a self signed certificate gets a warning, but http doesn't it is no less secure.

    A self-signed certificate gives a false sense of security, whereas the http: scheme gives a true sense of insecurity. A true sense is better than a false sense.

    It is really annoying that you have to pay someone a recurring fee just to add a little security.

    Every domain name registrant is entitled to a reasonable number of certificates from Let's Encrypt without charge. Or by "someone" do you refer to Gandi, Namecheap, Amazon Route 53, and other domain name registrars?

    1. Re:False sense of security by Anonymous Coward · · Score: 0

      That is HALF False.

      A self signed on an internal private network, is priestly safe and good form. That's a home firewall or other secure network appliance. Maybe to make it a little safe if you want to access from an EXTERNAL point add pass phrase, independent to the password. Think like CCSID for WiFi.

      There is no need to get cert from GOOGLE to just give you that secure feeling.

      PS: then Google has the keys to your kingdom... Thank You NSA.

    2. Re:False sense of security by tepples · · Score: 1

      A self signed on an internal private network, is priestly safe and good form.

      Provided all clients that will access the server, such as streaming boxes accessing your NAS, even allow use of self-signed certificates.

    3. Re:False sense of security by Anonymous Coward · · Score: 0

      A self-signed certificate gives a false sense of security, whereas the http: scheme gives a true sense of insecurity. A true sense is better than a false sense.

      If the browser made it clear that both self-signed and http were insecure, this wouldn't be a problem. That is what chrome and now safari are trying to do.

  11. The server signs every packet it sends by tepples · · Score: 1

    What you are saying is like saying that since you downloaded a piece of software through SSL, you are safe enough and you don't need to check the signature.

    Every connection you make to a TLS server is signed by that server. Are you assuming an attack model that involves tampering with the downloadable software before it even reaches the server?

    Furthermore, encryption is a weak way to guarantee that content hasn't been altered compared to signing.

    A form of signing is implicit in TLS, as it uses a message authentication code (MAC) to detect tampering with a packet's ciphertext. Older cipher suites in TLS separate the MAC and encryption into two steps; newer ones use authenticated encryption with associated data (AEAD), which bakes MAC into the cipher's mode.

  12. finally something starts to make sense by roman_mir · · Score: 0

    I have been talking about it for over a decade probably, if you want real security (anonimity) on the web you have to stop treating self signed certificates worse than plain HTTP. The amount of hate (follow the links and read the threads) was through the rough, but it only takes what, about a decade for something 'radical' to become mainstream?

    --
    You can't handle the truth.
  13. MITM by nyet · · Score: 1

    It should also warn if it detects corp MITM with forged root CA and wildcard certs.

  14. Next time try fixing some bugs by grungeman · · Score: 1

    I do not understand why Apple neglects Safari's development so much. It is years behind Chrome, and the only reason why it's market share is still that high is probably that iOS users simply have no alternative.

    If you ever tried to get involved into the development process of webkit you will soon understand why Safari has become the worst browser around. I posted a couple of bug reports over the last few months and the reaction I got was zero, absolutely nothing. During the same period I wrote some bug reports for Chromium and Firefox, and about half of the bugs were fixed, on the others there usually was a brief discussion. Screw webkit, I will no longer write bug reports because it obviously is just a waste of time.

    --

    Signature deleted by lameness filter.
    1. Re:Next time try fixing some bugs by Anonymous Coward · · Score: 0

      This. Many of the modern specs that WOULD make web development much less of a headache are supported by everything except Safari. Safari is like Internet Explorer used to be, requiring special-case browser-specific code for almost everything that just works fine in every other browser. I wish they'd either bring it up to date or get rid of it altogether.

    2. Re:Next time try fixing some bugs by coofercat · · Score: 1

      It's all part of their plan to make the worst browser in the world. It's hard to do - Microsoft have had two goes at it, and have generally done pretty well. Apple are trying pretty hard with Safari, and all 8 of it's users are providing them valuable feedback. Meanwhile, Apple are adding naggons to OSX so that you can never quite be free of Safari - and never quite being free of the worst browser is indeed one of it's finest features (see: IE).

      Fun anecdote: Yesterday, Firefox got its knickers in a twist, and I had to 'force close' it. As soon as I'd done that, I got an OSX notification asking if I'd like to try Safari. Sadly though, Firefox (or Chromium) will have to crash on an hourly basis before I'll consider using it instead - yes, it's that much worse.

  15. I'm sorry but HTTPS sucks by Anonymous Coward · · Score: 0

    Surely we can come up with a solution that actually works and does not make the web an expensive pain in the butt for individuals and small businesses.

    The certificate stuff is a scam. There's no reason the protocols used need to use a server and expensive certs, or some server on the web that will generate free certs but only with certain conditions and only with short lifetimes etc.

    Anybody can setup a simple web site using notmal HTTP, but setting up an HTTPS site is a hassle and it costs a ridiculous amount of time and money.

    With QUIC on the way and HTTP3 on the horizon, we need an encryption scheme that is on be default on any web server and that does not require certificates - just the encryption. If some people want some cert authority to supposedly prove that a site as actually what it says it is, then make that an optional thing aside from the encryption.

    Then and only then should web browsers freak-out users by claiming that an unecrypted site is not safe to use.

    Shot of that, this reeks of a scheme to further squeeze-out small sites and encourage most users to stivk with the tech giants for everything, which is funny given that some of these tech giants have been the worst abusers of user safety and priivacy.

    1. Re: I'm sorry but HTTPS sucks by Anonymous Coward · · Score: 0

      Encryption is futile without authentication. It's trivial to MITM. It would only protect from passive listeners. To authentucate, you need a certificate. Also, LetsEncrypt while gives short lifetime certificates, it gives tools to automate the renewal process. For me, it was set up once, and forget. Never had to tweak any settings. This scales even with thousands of webpages.

    2. Re:I'm sorry but HTTPS sucks by WaffleMonster · · Score: 1

      With QUIC on the way and HTTP3 on the horizon, we need an encryption scheme that is on be default on any web server and that does not require certificates - just the encryption.

      Encryption without trust is not just meaningless doublespeak it's actually dangerous.

      The public hears "encrypted" and thinks it means "secure".

    3. Re:I'm sorry but HTTPS sucks by Rockoon · · Score: 1

      When the public thinks "secure" they dont think the same thing that you do about what that means, so your point is less than nothing.

      --
      "His name was James Damore."
    4. Re:I'm sorry but HTTPS sucks by WaffleMonster · · Score: 1

      When the public thinks "secure" they dont think the same thing that you do about what that means, so your point is less than nothing.

      I disagree. Everyone knows what secure means. When someone buys something from an ecommerce site or logs into their bank account there is no confusion in anyone's mind as to what secure means in the context of what they are doing.

    5. Re:I'm sorry but HTTPS sucks by Rockoon · · Score: 1

      And so long as you always get to cherry pick what conditions to frame the situation you put "everyone" in ... you might as well declare unencrypted HTTP hitler, because thats about as much honesty and sense you are making.

      So again... you havent said shit... you havent made a point.. you are just waving your hands

      --
      "His name was James Damore."
    6. Re:I'm sorry but HTTPS sucks by WaffleMonster · · Score: 1

      And so long as you always get to cherry pick what conditions to frame the situation you put "everyone" in ... you might as well declare unencrypted HTTP hitler, because thats about as much honesty and sense you are making.

      SSL was invented by Netscape specifically to address needs of ecommerce.

      To this day one of the most common scenarios where general public cares most about security on the Internet has to do with monetary transactions conducted via Internet. For most this means buying shit from ecommerce sites and some form of online banking. It's in this context they are most exposed to and familiar with the concepts of security and encryption.

      So again... you havent said shit... you havent made a point.. you are just waving your hands

      I don't believe referencing common activity conducted by the general public where security has the highest profile exposure in their lives is cherry picking.

  16. Planned obsolescence by Anonymous Coward · · Score: 0

    As smartphones' navigators do not update their root certs, slowly over time they become unable to browse the web. See for example Android's default web browser.

    Then after two or three years, mechanically, the phone becomes unusable and people have to switch. Wonderful world I tell you!

  17. HTML resource checksums; HTTP Upgrade by Anonymous Coward · · Score: 0

    So what you’re saying is that we need content validation without full encryption for most things. This is how windows update (and I think apple update). Hashes of the packages are transferred securely, while the bulk data is in the clear. This allows the data to be verified, while still permitting caching to work.

    This is available as "Subresource Integrity":

    * https://en.wikipedia.org/wiki/Subresource_Integrity
    * https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

    While it protects against in-flight altering, it also prevents resource alteration on CDNs.

    I was disappointed that RFC 2817's opportunistic encryption was never deployed:

    * https://en.wikipedia.org/wiki/HTTP/1.1_Upgrade_header

    Each HTTP server could have a self-signed cert and while there was no authentication, it at least encrypted all traffic, which would prevent passive collection of traffic via 'tapping glass' like the NSA did in Room 621A:

    * https://en.wikipedia.org/wiki/Room_641A

    Certainly not 'good enough' for protecting login credentials, but certainly useful for surfing YouTube and raising the bar on the resources needed for a digital eavesdropper to monitor everything and perhaps forcing them to be more focused.

  18. Replay-resistant index, replayable data by tepples · · Score: 1

    How do you make sure a malicious actor will not serve the old content on purpose

    If you're using a signing-only scheme for long-lived bulk data, each version has a different URL. Then the index file, which was transmitted separately using a replay-resistant scheme, indicates that a different URL is the newest version of the file.

  19. um, who said... by Anonymous Coward · · Score: 0

    that "trust" requires an expensive cert and a third computer in the loop (the server which is inexplicable presumed to be trustworthy even thought there is no cert for it being verified by some other (fourth?) server, which would of course need a cert verified by some (fifth?) server, etc.

    In fact, who said that this current scheme/scam provides ANY true confidence and security?

    The old line "who died and made YOU king?" comes to mind. We're all just supposed to trust the servers that the web browser makers decide to trust? Who validates these servers and their certs? What if THEY decide to start discriminating, even using non-technical reasons like perhaps politics, or pressure from their local governments, or from big important corporations?

    What's required is a new scheme that ditches all this fake confidence. The new scheme should allow users to "sneakernet" certs and keys too... so a private business concern or members of an extended family, for example, could exchange digital certs in-person or via snail mail (like on USB keys) which would then be used on each end of the digital communications without the use of some 3rd party server.

    1. Re:um, who said... by WaffleMonster · · Score: 1

      that "trust" requires an expensive cert and a third computer in the loop (the server which is inexplicable presumed to be trustworthy even thought there is no cert for it being verified by some other (fourth?) server, which would of course need a cert verified by some (fifth?) server, etc.

      In fact, who said that this current scheme/scam provides ANY true confidence and security?

      The old line "who died and made YOU king?" comes to mind.

      What I actually said is encryption without trust is meaningless doublespeak. This is a basic fact of reality not open for debate any more than the outcome of 1 + 1 is open for debate.

      The rest is you yourself attacking a strawman created exclusively from your own imagination insinuating things neither stated or implied. My response is exclusively in the context of "encryption" without "trust" advocated by OP.

      Saying a specific source of trust is no good or other sources can be used instead is NOT the argument of OP: "we need an encryption scheme that is on be default on any web server and that does not require certificates - just the encryption"

      What's required is a new scheme that ditches all this fake confidence. The new scheme should allow users to "sneakernet" certs and keys too... so a private business concern or members of an extended family, for example, could exchange digital certs in-person or via snail mail (like on USB keys) which would then be used on each end of the digital communications without the use of some 3rd party server.

      I've been advocating trust off-ramps by limiting scope of global trust anchors exclusively to role of initial service discovery for many many years.

      I've advocated for adoption of specific readily available and accessible technological solutions (standalone secure authentication) denied from being rolled into browsers for purely selfish political reasons. More importantly I've implemented these solutions in the software I develop.

  20. Zach Patterson / ZIP "Greatest Hits" (lol, not) by Anonymous Coward · · Score: 0

    See how STUPID "ZIP" (Zach Patterson) the CHIMP is (tried to take credit for what I solved before him) https://tech.slashdot.org/comm... (he needs to LEARN TO READ)!

    I even SHOW ways to do it YOURSELF https://tech.slashdot.org/comm... (he couldn't).

    Delphi/FreePascal/ObjectPascal HAS no issue w/ null-term'd string bufferoverflows - C does, C++ can UNLESS you do what I said 1st loser.

    Tell us about CODE SIGNING (which has been STOLEN & ABUSED) https://www.helpnetsecurity.co... MY METHOD CAN'T BE (upmodded +2 INTERESTING in CODING FOR DEFCON no less) https://it.slashdot.org/commen...

    "I'm a much better programmer than APK" - by Anonymous Coward ZIP on Monday October 08, 2018 @11:27PM (#57449082) FROM https://yro.slashdot.org/comme...

    BIG TALK - Yet ZIP has nothing to show in programs. I can https://news.slashdot.org/comm... from registered /.ers liking/using/praising my work (& 100k users worldwide too). He can't.

    LIAR ZIP says he has no account "I don't have an account, so I don't have mod points" https://news.slashdot.org/comm...

    Yet LIAR ZIP says he downmods my posts (IMPOSSIBLE MINUS AN ACCOUNT on /.): "I down-modded a few of your post on other threads" - by Anonymous Coward "ZIP" on Thursday October 11, 2018 @11:31AM (#57461058) FROM https://yro.slashdot.org/comme...

    APK

    P.S.=> KEEP IMPERSONATING ME CHIMP - this comes out every time, lol!... apk

  21. ZIP = "better programmer" (lol, not) by Anonymous Coward · · Score: 0

    You said it ZIP: Where's your work everyone can see/use? It's not. It's HOTAIRWARE/NOTWARE (lol) "I'm a much better programmer than APK" - by Anonymous Coward ZIP on Monday October 08, 2018 @11:27PM (#57449082) FROM https://yro.slashdot.org/comme...

    The BETTER PROGRAMMER w/ no programs, lol - @ least you can say your "code" has NO BUGS - of course, it also does ZERO (like you) since it does nothing @ all, lol!

    You hotair BLOWHARD talker, lol!

    You f'd up ZIP https://tech.slashdot.org/comm...

    Yet 100,000++ users of my ware & dozens of even REGISTERED /.ers like/use/praise MY work https://news.slashdot.org/comm... vs. your HOTAIR talk punk!

    * LMAO!

    (Let's see how YOU take it when I publicly SHIT ALL OVER YOU by letting FACTS of YOUR FUCKUPS vs. ME https://science.slashdot.org/c... do the job for me)

    APK

    P.S.=> You STUPID & LAZY all talk chimpanzee - KEEP IMPERSONATING me - I'll expose your BLOWHARD INCOMPETENCE publicly, lol... apk

  22. ZIP = "better programmer" (lol, not) by Anonymous Coward · · Score: 0

    You said it ZIP: Where's your work everyone can see/use? It's not. It's HOTAIRWARE/NOTWARE (lol) "I'm a much better programmer than APK" - by Anonymous Coward ZIP on Monday October 08, 2018 @11:27PM (#57449082) FROM https://yro.slashdot.org/comme...

    The BETTER PROGRAMMER w/ no programs, lol - @ least you can say your "code" has NO BUGS - of course, it also does ZERO (like you) since it does nothing @ all, lol!

    You hotair BLOWHARD talker, lol!

    You f'd up ZIP https://tech.slashdot.org/comm...

    Yet 100,000++ users of my ware & dozens of even REGISTERED /.ers like/use/praise MY work https://news.slashdot.org/comm... vs. your HOTAIR talk punk!

    * LMAO!

    (Let's see how YOU take it when I publicly SHIT ALL OVER YOU by letting FACTS of YOUR FUCKUPS vs. ME https://science.slashdot.org/c... do the job for me)

    APK

    P.S.=> You STUPID & LAZY all talk chimpanzee - KEEP IMPERSONATING me - I'll expose your BLOWHARD INCOMPETENCE publicly, lol... apk