Hacker News new | past | comments | ask | show | jobs | submit login

The interests of Google and users are aligned when it comes to making sure that intelligence agencies and other criminals can't read everyone's communications. I don't trust Google across the board but I'm still happy that Google promotes HTTPS.

If a nation-state attacker decides they really want your secrets they will probably get them. This can mean measures up to and including clandestine hardware modifications of systems you use. HTTPS isn't going to save you in that case.

HTTPS can, however, take a lot of the sting out of pervasive information insecurity promoted by nation states. It forces nation state attackers to go from passive to active attacks if they want to tamper with your system or read the contents of your communications. Pinned keys can thwart MITM tampering, when pinning is available, and even when an active attack can compromise security it's more likely to leave traces. It forces a natural balance on intelligence agencies that are (sadly, apparently) un-constrained by the consent of the governed: use that great 0-day exploit to monitor everyone you slightly suspect and it will be discovered/fixed that much faster.

HTTPS doesn't do anything to prevent metadata based surveillance, of course. But keeping the contents of communications private still imposes significant and worthwhile limitations on how metadata surveillance is used for further targeting. Any broad security measures that make the NSA's adversarial role harder to perform also makes life harder for for attackers from other nation-states; I'd rather that everybody be able to keep the contents of their conversations secret than nobody be able to to, if we have to pick one extreme or the other.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: