Eric Mill

I think it depends on what you're comparing the current system with, right? I mean sure if its either no hoop jumping or you have to pay some money then you can go figure ok the person willing to give up bucks and go through the trouble is probably a little more reliable because of that. But how is that type of system ideal or secure? Currently, ssl certs give me very little assurance that any data over the connection is not being backdoored/sniffed to whomever, that the private certs arent compromised, etc. I think we shouldn't be trusting people because of hoops they go through, but because the system we use doesnt allow fraudelent players to stay in the game. Personally, I'd like to see it head in this direction:

https://github.com/okTurtles/dnschainhttps://github.com/okTurtles/dnschain

also for some more background on some concerns with CAs see: https://konklone.com/post/certificate-authorities-are-actually-a-tremendous-problem

https://mobiforge.com/news-comment/no-https-then-bye-bye-geolocation-in-chrome-50

https://www.wordfence.com/blog/2017/01/chrome-56-ssl-https-wordpress/

https://blog.mozilla.org/security/2015/04/30/deprecating-non-secure-http/

http://stackoverflow.com/questions/32106849/getcurrentposition-and-watchposition-are-deprecated-on-insecure-origins

https://konklone.com/post/were-deprecating-http-and-its-going-to-be-okay

http://forums.whirlpool.net.au/archive/2598616

Just some random places to start to see why the major web browsers are not going to spend any time on non-encrypted protocols. A lot of devs need to help themselves and move to encrypted to connections before they are forced at browser-point.

The interesting thing about Quora is that it has a lot of personal anecdotes directly from people involved. That's really unfortunate considering all the dark patterns and user hostile design the site utilizes. Along with their registration paywall, they also do other things to hoard all that user-contributed knowledge: https://konklone.com/post/quora-keeps-the-worlds-knowledge-for-itself. Really disappointing, imagine if Stack Overflow was run this way. I hope this rant is on-topic enough considering that the post is just quoting a Quora source and if Quora ever shuts down or fully hides itself, these kinds of posts will be all that we have of the knowledge shared by these experts.

It's interesting to think of it this way. Clearly, the attackers (being ISPs in this case) don't see it this way or don't want to see this sort of MITM this way. Following one of the links in the article [1], you get some great quotes:

> Comcast injects ads into unencrypted traffic, because "it's a courtesy, and it helps address some concerns that people might not be absolutely sure they're on a hotspot from Comcast".

So maybe someone out there actually feels this way when they find content has been directly injected in their unencrypted browsing session. I sure don't.

[1] https://konklone.com/post/were-deprecating-http-and-its-going-to-be-okay

Hashes are generally a part of the signature generation used with certificates. See for example "What role do hashes play in TLS/SSL certificate validation?" -> https://security.stackexchange.com/questions/67512/what-role-do-hashes-play-in-tls-ssl-certificate-validation

In certificates, md5 - and sha1 - was used quite some time after it was known to be weak, I suspect OP was thinking of that.

This article seems to give a good summary what happened with sha1, mentions md5 in passing and links the related chromium issue: https://konklone.com/post/why-google-is-hurrying-the-web-to-kill-sha-1

Eric Mill's excellent post about Slack's new arbitration clause was just merged into this thread by the moderators. Here is the URL:

https://konklone.com/post/slack-is-now-forcing-users-into-arbitration-and-that-is-terrible

The post is titled "Slack is now forcing users into arbitration and that is terrible." I highly recommend reading it, as there's no mention of the arbitration ToS change in Slack's own blog post.

Edit: Also worth reading the ongoing conversation between Stewart Butterfield (Slack CEO) and Konklone on Twitter: https://twitter.com/stewart/status/536975596920635393