* S Mathias wrote on Wed, Jan 19, 2011 at 03:29 -0800: > Ok. It's a Firefox Add-on: > https://www.eff.org/https-everywhere > 3) Can someone trust this Add-on? Is it safe to install/use?
It isn't 100% safe. There always is a risk. > 4) If it's so great why isn't it more prevalent? > What's youre opinion? Or answer? :\ Against what kind of attack should it protect? Against traffic sniffing by ISPs preventing user profiling? I think for sensitive applications like online banking or so an automatic `enable SSL if accidently possible' isn't sufficient. For non-sensitve applications like editing Facebook information visible to the public it seems not to add much (assuming that Facebook correctly secures sensitive operations like loging in, yes, I know that this is unlikely :)). Personally I think in those cases it might not be worth spending the additionally needed computing power... I guess it is a similar concept like `opportuntistic encryption' (FreeS/WAN), which has advantages and disadvantages. What do you think? BTW, I dislike the name `everywhere': `HTTPS Everywhere can protect you only when you're using sites that support HTTPS and for which HTTPS Everywhere includes rules.' I would expect that if an attacker hijacks some link or performs some phishing via let's say facebook.com.malicious.net, the plugin probably does not help. oki, Steffen End of mail -- About Ingenico: Ingenico is a leading provider of payment, transaction and business solutions, with over 15 million terminals deployed in more than 125 countries. Over 3,000 employees worldwide support merchants, banks and service providers to optimize and secure their electronic payments solutions, develop their offer of services and increase their point of sales revenue. http://www.ingenico.com/. This message may contain confidential and/or privileged information. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message. Thank you for your cooperation. P Please consider the environment before printing this e-mail ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
