From owner-freebsd-security@freebsd.org Tue Dec 5 22:08:53 2017 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 67A48E848D8 for ; Tue, 5 Dec 2017 22:08:53 +0000 (UTC) (envelope-from gordon@tetlows.org) Received: from mail-vk0-x234.google.com (mail-vk0-x234.google.com [IPv6:2607:f8b0:400c:c05::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 1BE9A74E35 for ; Tue, 5 Dec 2017 22:08:53 +0000 (UTC) (envelope-from gordon@tetlows.org) Received: by mail-vk0-x234.google.com with SMTP id o70so1339025vkc.9 for ; Tue, 05 Dec 2017 14:08:53 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tetlows.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:content-transfer-encoding:in-reply-to :user-agent; bh=96rKsaj9RqEUHHEqrooWMlrWYI99RktP/mr/LeoRyKg=; b=EvvZbauqSz2Fufa0SJryRrxZkAmzljUsFubx4sHOMAxqExX6yiN3knSRv5uORrS0Fk ThXjIB4UunYtJKa4VcnZ6Xsk6GE9Trj+06TcrMrISNrBOMF0zEtIgk15cQ0zoNnQ4GNs igGNAMLe+MDUU0wjr5piRh/CIAju1hM1k3Ckg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:content-transfer-encoding :in-reply-to:user-agent; bh=96rKsaj9RqEUHHEqrooWMlrWYI99RktP/mr/LeoRyKg=; b=lgmBQbFJaP6PTmQEzWNacuIXUfU21RKjEpL0yuBReI/TtFLdHpfThWlv8Oedn21W2d XNuX+edFunR/BT+2PnZ4jFlQ2RYIvXONr3AmiiyKjWNo1MaRCSYSLueroys55G1KWqnZ IWAgembM8dCIO8b8Zmkf/kQCxXxy7Lg/4dgBt/nC3gBcW+rC4Yt5qI6xC7uT4vqGsklz cGi7VDmOsjE28bRrLreknGdhjf95X1s+L36N/fNDXAQTuZkO5qv2X23IsfgCjoOtn/1f yx/F82sN1zNGzNu5YwRQoKHbiuWkXvp4yZOtkO2lMj8RufnV6ttDPO2SomsbJQ6YUq5c 2FyQ== X-Gm-Message-State: AKGB3mJ4bK+TA1a5ADGk0Zkdddg6rivGpq+v+usSjBfnagoSSFGJ5JRR K3+7mdIULoFD8/+i2t0MkCiETbwsdQ== X-Google-Smtp-Source: AGs4zMaOd7dvwOscGqfApRw//sB+EZJQD1D5IfwMYIlXGpk4MHqBhkvEBOzRZ9kswpFg+zX2X+tToQ== X-Received: by 10.31.196.195 with SMTP id u186mr6425837vkf.189.1512511732228; Tue, 05 Dec 2017 14:08:52 -0800 (PST) Received: from gmail.com ([2607:fc50:0:7900:0:dead:beef:cafe]) by smtp.gmail.com with ESMTPSA id v21sm615012vkd.12.2017.12.05.14.08.51 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 05 Dec 2017 14:08:51 -0800 (PST) Date: Tue, 5 Dec 2017 14:08:49 -0800 From: Gordon Tetlow To: Dewayne Geraghty Cc: freebsd-security@freebsd.org Subject: Re: http subversion URLs should be discontinued in favor of https URLs Message-ID: <20171205220849.GH9701@gmail.com> References: <97f76231-dace-10c4-cab2-08e5e0d792b5@rawbw.com> <5A2709F6.8030106@grosbein.net> <11532fe7-024d-ba14-0daf-b97282265ec6@rawbw.com> <8788fb0d-4ee9-968a-1e33-e3bd84ffb892@heuristicsystems.com.au> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <8788fb0d-4ee9-968a-1e33-e3bd84ffb892@heuristicsystems.com.au> User-Agent: Mutt/1.9.1 (2017-09-22) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Dec 2017 22:08:53 -0000 On Wed, Dec 06, 2017 at 08:55:00AM +1100, Dewayne Geraghty wrote: > On 6/12/2017 8:13 AM, Yuri wrote: > > On 12/05/17 13:04, Eugene Grosbein wrote: > >> It is illusion that https is more secure than unencrypted http in a > >> sense of MITM > >> just because of encryption, it is not. > > > > > > It *is* more secure. In order to break it, you have to have > > compromized https authorities. Some state actors have plausibly done > > this. http, on the contrary, can be altered by anybody who has access > > to the wire, which is generally a much wider set. > > > > > > Yuri > > Yuri, > It can be illusory.   My last job was as Sec Mgr for a large bank.  They > disabled cert checking on client devices, placed a wildcard cert at the > internet boundary and captured all https unencrypted.  An alternative > approach to advocate is dnssec.  :) That's a specific decision made by a business as to how they are going to run their end-points. We can never help in that scenario. Using this as a reason to not move to HTTPS is a fallacy. We should do everything we can to help our end-users get FreeBSD in the most secure way. Regards, Gordon