Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The problem is a matter of trust.

The information therein is potentially bad for their reputation, and not "signing on the dotted line" leaves scope for them to come out in the future and say "that's not actually what we said, must have been MitMd" (for example).

An institution of this calibre should be considered viable to pull off something this obtuse to your average person, and thus should not be given the benefit of the doubt. This is just one of many possible effects including SEO penelties amongst others.



That risk doesn't make any sense when they can also just edit the page content on their end. Are we taking seriously the risk MIT would try and blame editing their own page on some kind of MITM that successfully masked true page content a) consistently b) for 100% of readers c) applied at an attack location in the network that someone had access to that isn't the same someone as controls the TLS-verified content hosting? This smells like rhinoceros-repellent levels of paranoia.


I'm not seriously suggesting this is likely, im just presenting a hypothetical scenario, and it doesn't need to be plausible in order for it to be used as a narrative. Do it properly, remove any doubt, secure your (one's) website so people _know_ the information came from you.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: