Use HTTPS

Code of conduct, suggestions, and information on forums.debian.net.
Message
Author
slim shady 45
Posts: 8
Joined: 2018-08-02 14:40

Re: Use HTTPS

#21 Post by slim shady 45 »

everybody here has already assumed that the whole world uses wifi.....
nobody uses cable ethernet broadband/that can be easily tapped via packet capturing.
so easy to get passwords............
unrelated KRACK stories.
Mint, Ubuntu ... ...... .............. mostly have https.............
ssl is not needed

arzgi
Posts: 798
Joined: 2008-02-21 17:03
Location: Finland
Been thanked: 3 times

Re: Use HTTPS

#22 Post by arzgi »

slim shady 45 wrote:everybody here has already assumed that the whole world uses wifi.....
nobody uses cable ethernet broadband
Nobody has told me, that I should not use etheret. So I've plugged every box that has ethernet connector to my router. Some I use don't have one, so I enabled also wifi.

And surely you know, if you are using wifi, net trafic very soon goes to cable, Wif's range is short.

User avatar
debiman
Posts: 3064
Joined: 2013-03-12 07:18

Re: Use HTTPS

#23 Post by debiman »

slim shady 45 wrote:everybody here has already assumed that the whole world uses wifi.....
no, nobody assumed that in this thread. it is simply not true. why are you saying it?
nobody uses cable ethernet broadband...
again, this is not true.
...that can be easily tapped via packet capturing.
what? why should that be easy? how? and compared to what?
so easy to get passwords............
no, it is not easy to get passwords........
unrelated KRACK stories.
your post is unrelated indeed.
Mint, Ubuntu ... ...... .............. mostly have https.............
ssl is not needed
yes, ALL linux distros "have" https ... just like windows, iOS etc.
however, saying SSL is not needed without mentioning TLS betrays deep ignorance. that goes for the post before that one, too.

slim shady 45
Posts: 8
Joined: 2018-08-02 14:40

Re: Use HTTPS

#24 Post by slim shady 45 »

sorry i meant that the people thinking ssl is not needed. my fault///
i meant certificates are not needed. without it also will be fine.


and my local cable operator LAN is not very secure..... people always reported about net theft// i.e using software like net cut - MAC copy and paste.
that is why https is always preferred.
login passwords have been stolen in the past.
we are using linux over windows as a privacy issue.
if a linux user refuses to acknowledge this... then there is nothing more that i can say.

User avatar
debiman
Posts: 3064
Joined: 2013-03-12 07:18

Re: Use HTTPS

#25 Post by debiman »

slim shady 45 wrote:sorry i meant that the people thinking ssl is not needed. my fault///
i meant certificates are not needed. without it also will be fine.


and my local cable operator LAN is not very secure..... people always reported about net theft// i.e using software like net cut - MAC copy and paste.
that is why https is always preferred.
login passwords have been stolen in the past.
we are using linux over windows as a privacy issue.
if a linux user refuses to acknowledge this... then there is nothing more that i can say.
your post doesn't make any more sense than the previous one.
you are really confusing things, using wrong terms, mushing them together...

whatever, we're still glad you're using linux and not windows.

slim shady 45
Posts: 8
Joined: 2018-08-02 14:40

Re: Use HTTPS

#26 Post by slim shady 45 »

its just that you like the old way only :(

slim shady 45
Posts: 8
Joined: 2018-08-02 14:40

Re: Use HTTPS

#27 Post by slim shady 45 »

and this is not my post either

User avatar
debiman
Posts: 3064
Joined: 2013-03-12 07:18

Re: Use HTTPS

#28 Post by debiman »

slim shady 45 wrote:and this is not my post either
Image
:D

username1029
Posts: 8
Joined: 2018-10-17 08:47

Re: Use HTTPS

#29 Post by username1029 »

GarryRicketson wrote: Back to the https issue, and this is something I said before in the other topics. To start with the only person that can add https, or ssl to the forum / website is the owner/admin of the server, the suggestion or request has been made several times, but for what ever reason they choose not to do that.
What's the mailing list for contacting those in charge of the server?

arochester
Global Moderator
Global Moderator
Posts: 2009
Joined: 2010-12-07 19:55
Has thanked: 1 time
Been thanked: 2 times

Re: Use HTTPS

#30 Post by arochester »

What's the mailing list for contacting those in charge of the server?
http://forums.debian.net/memberlist.php ... le&u=22484

needsch
Posts: 2
Joined: 2012-06-07 12:07

Re: Use HTTPS

#31 Post by needsch »

It is unbelievable that this needs to be discussed in 2018...

The reasons given for not implementing HTTPS are ridiculous. The logic is completely flawed. Just because HTTPS does not provide 100% security and can be bypassed by exploiting security vulnerabilities in apps implementing or using it, does not at all mean that it doesn't add security at all.

"Only a Sith deals in absolutes."
Admin here = Sith? :lol:

sallybrown
Posts: 2
Joined: 2018-11-24 09:21

Re: Use HTTPS

#32 Post by sallybrown »

needsch wrote:It is unbelievable that this needs to be discussed in 2018...

The reasons given for not implementing HTTPS are ridiculous. The logic is completely flawed. Just because HTTPS does not provide 100% security and can be bypassed by exploiting security vulnerabilities in apps implementing or using it, does not at all mean that it doesn't add security at all.
I don't suppose you would care at all, but I use an old computer and an old browser. Adding https to this site would lock me out of using it (as my browser will not recognize the certificate). The same has happened with numerous other sites already. I can no longer use those sites. I cannot update my browser (because mozilla says my OS is "deprecated"). I cannot update my OS (because microsoft and linux both say my computer is "deprecated"). I cannot buy a new computer because I have no money (I guess I'm "deprecated").

Not everyone in the world is rich enough to buy whatever they're told to whenever large corporations decide to boost their profits by "deprecating" all the stuff that would otherwise still work just fine.

I'm just pointing it out, that's all.

User avatar
Head_on_a_Stick
Posts: 13450
Joined: 2014-06-01 17:46
Location: /dev/chair

Re: Use HTTPS

#33 Post by Head_on_a_Stick »

sallybrown wrote:I cannot update my OS (because microsoft and linux both say my computer is "deprecated").
Have you tried OpenBSD? They support much older machines than Linux and the resource usage is significantly lower as well.

In respect of https:

http://n-gate.com/software/2017/07/12/0/

^ I'm with that guy :D
Black Lives Matter

Debian buster-backports ISO image: for new hardware support

sallybrown
Posts: 2
Joined: 2018-11-24 09:21

Re: Use HTTPS

#34 Post by sallybrown »

Head_on_a_Stick wrote:In respect of https:

http://n-gate.com/software/2017/07/12/0/

^ I'm with that guy :D
It took me a while to work out if that page (and therefore you) were for or against https, mostly because I have no idea what a "block quote" is and because, laughably, when I go to the site that it links to (https://doesmysiteneedhttps.com/), I get "An error occurred during a connection to doesmysiteneedhttps.com. Cannot communicate securely with peer: no common encryption algorithm(s)." Perhaps that only seems laughable to me though.
Head_on_a_Stick wrote:
sallybrown wrote:I cannot update my OS (because microsoft and linux both say my computer is "deprecated").
Have you tried OpenBSD? They support much older machines than Linux and the resource usage is significantly lower as well.
I tried that once and didn't like it. It reminds me of the terminals we had to use when I made the mistake of doing a university degree. Perhaps I should add to "I cannot update my OS", that "I don't want to update my OS". I'm perfectly happy with XP and I don't really care how safe/unsafe anyone else thinks it is. I've never had a virus in 20 years of using it, and I've never run an antivirus either. I have a firewall and a HIPS system. The only time either have ever flagged anything was when I purposefully ran that sample virus whatnot (the one that all antivirus programs recognize as a virus, and that's used to test if your antivirus is working).

User avatar
Head_on_a_Stick
Posts: 13450
Joined: 2014-06-01 17:46
Location: /dev/chair

Re: Use HTTPS

#35 Post by Head_on_a_Stick »

sallybrown wrote:when I go to the site that it links to (https://doesmysiteneedhttps.com/), I get "An error occurred during a connection to doesmysiteneedhttps.com. Cannot communicate securely with peer: no common encryption algorithm(s)." Perhaps that only seems laughable to me though.
No, that is funny :D

n-gate.com is utterly brilliant but the author is rather scathing (which I find entertaining).
sallybrown wrote:I'm perfectly happy with XP
Fair play to you, I loved Win XP, it was ace.
Black Lives Matter

Debian buster-backports ISO image: for new hardware support

pcalvert
Posts: 1924
Joined: 2006-04-21 11:19
Location: Sol Sector

Re: Use HTTPS

#36 Post by pcalvert »

It's a good idea for websites that people need to log into to use, or ones that have web forms for entering personal information. But I don't understand the push to make every website use SSL.

Phil
“It is better to believe than to disbelieve; in doing so, it brings
everything into the realm of possibility.” — Albert Einstein

User avatar
None1975
Posts: 1019
Joined: 2015-11-29 18:23
Location: Lithuania, Vilnius

Re: Use HTTPS

#37 Post by None1975 »

pcalvert wrote: But I don't understand the push to make every website use SSL.Phil
Maybe it is more secure? HTTP protocol is built on top of TCP. TCP guarantees that the data will be delivered, or it is impossible to deliver (target not reachable, etc.). You open a TCP connection and send HTTP messages through it. But TCP does not guarantee any level of security. Therefore an intermediate layer named SSL is put between TCP and HTTP and you get the so called HTTPS. This way of working is called tunneling – you dump data into one end of (SSL) tunnel and collect it at the other one. SSL gets HTTP messages, encrypts them, sends them over TCP and decrypts them again at the other end. Encryption protects you from eavesdropping and transparent MITM attack (altering the messages). But SSL does not only provide encryption, it also provides authentication. Server must have a certificate signed by a well known certification authority (CA) that proves its identity. Without authentication, encryption is useless as MITM attack is still possible. The attacker could trick you into thinking that he is the server you want to connect to. Private chat with the devil is not what you want, you want to verify that the server you are connecting to really is the one you want to connect to. Authentication protects you from MITM.

More readings here.
OS: Debian 10.3 Buster / WM: xmonad
Debian Wiki | DontBreakDebian, My config files on github

User avatar
Rildebai
Posts: 87
Joined: 2016-04-30 09:27
Location: Ireland

Re: Use HTTPS

#38 Post by Rildebai »

Is there any plan to implement https for DUF in the future? :?:
Write programs that do one thing and do it well. ~ Doug Mcllroy on the UNIX Philosophy

User avatar
GarryRicketson
Posts: 5872
Joined: 2015-01-20 22:16
Location: Durango, Mexico

Re: Use HTTPS

#39 Post by GarryRicketson »

Not that I know of.

User avatar
llivv
Posts: 5484
Joined: 2007-02-14 18:10
Location: cold storage

Re: Use HTTPS

#40 Post by llivv »

@ NewHere
very insightful thought regarding wifi - in my opinion anyways.
With every new iteration of hardware there appears to be a SERIOUS lack of
attention to personal security. ie:
How may ways does your hardware connect?
If you haven't already thought about this issue, maybe it's time you looked into
the ways you connect.
Obviously ----
blah blah blah ->
If you are worried now, the future offers no hope for a better solution, so way
care anyway and keep those blinders firmly in place.

as of January 3, 2019
Rutaba Rais
has this to say concerning secure browsing.
https://www.beencrypted.com/5-best-secure-browsers/
may it help some to feel they still have some control over how much of their personal data is kept private from others (private, corporate or just plain old crack addicts) that might use it for personal or professional gains.

ps: llivv bows gracefully to h_o_s_a' s slow clapping of hands
and hopes he enjoyed the show performed especially for him.
In memory of Ian Ashley Murdock (1973 - 2015) founder of the Debian project.

Post Reply