Alex Morales

Did this guy go to jail for "false advertising"? en.wikipedia.org/wiki/Martin_Shkreli

Very nice arguments y'all make. And yet: en.wikipedia.org/wiki/Securities_fraud

Let's try again. If someone breaks into my house but doesn't steal anything, is that a crime?

That's all I need to know!

@Barman Is making a false statement, on purpose, on writing, with the intent of selling up something a crime? Y/N?

@both Let's do a little though experiment. If someone breaks into my house but doesn't steal anything, is that a crime?

Which is think is pretty understandable, because his behavior was not appropiate

Even for you mods, that's crossing it

And that's crossing the line

Someone didn't like that, IDK why, maybe because it didn't fit with their view of the world of "just use HTTPS everywhere".

Do it please, check comment history, someone started deleting comments where I explained my particular scenario and how it made sense.

Can you see the comments that were deleted?

Yeah sure, see it.

How is that wrong?

Yeah

That is not true.

You remember I'm pretty sure it was you.

Yeah exactly Xander

No, but I think why

Unlikely... but why? Just state the reason.

If there's a reason why it should stay locked please state it

Anyway, I want this question unlocked security.stackexchange.com/questions/116144/…

@AviD You're wrong on that.

Double standards, but I don't care.

Also again, I may remind you that yesterday you had a deplorable attitude as well.

Yeah ok, language, got it. Can we move on?

I'm here because I want to reopen the question for editing, because I think it is a valuable question.

@kalina I have not idea what you're talking about neither I'm here to discuss that.

"I'm not really willing to hear you berate other moderators for doing their job" Never said that, but whatever then, believe whatever you want.

Phew, AviD if you wanna know my side of the story, I'm willing to. You're the only guy who appears to appeal to reason before abusing their mod things. (Yeah expletives are not allowed, may I remind you, you also referred to me in a deplorable way yesterday? But I guess it's ok if you do it)

No idea about when it does. But 16 min, I can wait, thanks

Cool, I expected that, but given that it is not a helpful question (as stated by you), why keep it? ;)

Even if they intercept a client request and write back a forged response (to the client) they couldn't alter it on the way to the server, or else the signature will be void. That's the point of signing.

What would be the problem then? Everything has a MitM at some point or another. What's important is to ensure that the message that went through could only be signed by the appropiate entity. "I can send any challenge to the client and he will solve it for me." No, absolutely not, that's not how things work in the web. The web doesn't push things into the browser, it's the only way around.

Yeah, well these assholes don't know any better. I'm banned from posting comments, replying to my own question etc...

Cont. well, since I'm deploying this to my clients here and there (most of them people who barely know how to turn on the computer and send me their data) I need to think of the easiest way to achieve this, from an user perspective. HTTP through port 80 over TCP/IP is the most widely deployed medium to exchange information that ever existed, so I'm going to take advantage of that. And yeah that's it. If you think of a better alternative for solving the overall problem, please let me know.

A web browser, easiest thing to deploy too, they already have one.

@NeilSmithline Sure thing, some guys need to send data to my HQ, the information they send is not sensitive per se so I don't care if it goes in cleartext what I do care is to be absolutely certain that they are the ones providing the information on the other side (as well as which one of them is it). I know already that security experts love to repeat buzzwords here and there because they read it everywhere in magazines and blogsm but when these guys enter the real world (which may never happen, btw) they'll find out that it's not necessarily made of all the things they assume to be true.

@billc.cn Thank you, that's awesome, I haven't considered that.

@billc.cn What if it doesn't have the key?

@symcbean It was exchanged through a secure channel. And yes this is going to happen with every request.

We can't just deploy HTTPS there, we need to make it work through HTTP.