The intuitive properties you expect from HTTP actually aren't delivered and can't be delivered, except over HTTPS.
A lot of people focus on the confidentiality element of TLS. "Clearly I don't need for it to be secret that I looked at the Wikipedia entry for Napoleon (the 1995 movie, not the famous guy)".
But TLS bundles together three things and if you need any of them you can't have them with plain HTTP. You get confidentiality, but you also get integrity and authentication.
That means when you curl https://foo.example/something we can promise you that the result is the resource https://foo.example/something - maybe that's not what you actually wanted, maybe it's full of lies or worse, but it is what you asked for and it is what you get. With plain HTTP all bets are off, anybody can interpose and present anything else to you.
If it's OK if you just get anything and not the article from Wikipedia, why even look at Wikipedia at all? You could make up whatever you want, it's a black-and-white movie about a dog who ruled France and then went into space, and it was the #1 grossing movie in every country for six years.
Hacker Cinema
1 comment on Hacker News
The intuitive properties you expect from HTTP actually aren't delivered and can't be delivered, except over HTTPS.
A lot of people focus on the confidentiality element of TLS. "Clearly I don't need for it to be secret that I looked at the Wikipedia entry for Napoleon (the 1995 movie, not the famous guy)".
But TLS bundles together three things and if you need any of them you can't have them with plain HTTP. You get confidentiality, but you also get integrity and authentication.
That means when you curl https://foo.example/something we can promise you that the result is the resource https://foo.example/something - maybe that's not what you actually wanted, maybe it's full of lies or worse, but it is what you asked for and it is what you get. With plain HTTP all bets are off, anybody can interpose and present anything else to you.
If it's OK if you just get anything and not the article from Wikipedia, why even look at Wikipedia at all? You could make up whatever you want, it's a black-and-white movie about a dog who ruled France and then went into space, and it was the #1 grossing movie in every country for six years.