alt Hacker NewsPeople don’t understand things and act shocked when they learn apt and Steam packages are downloaded over HTTP. You only need encryption for private information. CA public keys are not that. But you do need verifiable signatures.
Replies
sippingabonedry • yesterday at 8:08 PM
I partly blame Google and Mozilla for the HTTP hysteria.
You publicly demonize something long enough and otherwise intelligent people start believing HTTPS is a magic invisibility cloak or the Good Housekeeping seal of approval for the web.
It is a tool in the toolbox and nothing more. Wearing safety goggles while making spaghetti is equally stupid.
➕ show 1 reply
It kind of makes sense opsec wise when you are on a network with adversaries though.
1) Others knowing knowing exactly which package you are downloading could give them a very clear way to fingerprint and target services you are running
2) HTTPS could allow you to potentially reduce your risk surface in a case where there is a bug in Steam's signature checker itself and someone sends a crafted payload instead of game files. Server validation would have prevented that. This has actually happened with apt before: CVE-2019-3462.
Odds are small, but I believe in DiD. I could imagine an attacker with nothing better to do could get up to this on say, a Uni's network.
And before you come at me with I should be using a VPN to protect against these scenarios, I do that already. This is about HTTPS being a sane default when possible.