[no subject]

Against hostile State actors, HTTPS only provides a false sense of
security.  If your threat model includes the CIA, reliance on HTTPS is a
fundamental error in the "game over" category.

The HTTPS procotol implemented in web browsers relies on digital
signatures by 3rd parties called Certificate Authorities to
transparently verify that the key used for the "secure" connection
belongs to the website in question.  Any actor who owns a copy of any
one of the numerous Certificate Authorities' signing keys can sign an
SSL certificate in any website's name, and it will be accepted as
authentic by any web browser.

The HTTPS trust model is broken at the foundation.  This does not make
HTTPS useless; smaller criminal organizations and hostile individuals do
not normally have access to Certificate Authority signing keys, and so
can not effectively do man in the middle attacks against HTTPS
connections.  In most cases implementing HTTPS is worth doing - as long
as it is understood that this provides no protection against large, well
funded adversaries.

> Please help me explain them how digital attacks works, or please someone
> make a MITM video-screencast to show them how urgent and important is to
> upgrade all of the connections to HTTPS.

See above:  It seems likely that the people at videolan.org have a basic
understanding of how digital attacks work, more so than someone who
believes that HTTPS can interfere with attacks by State actors.

If it is urgent and important for videolan.org to use HTTPS, preventing
MITM attacks by State actors (or other criminal gangs with substantial
resources) is not the reason.

A more effective way to protect against malware injection via
substitution of executables in transit, is for the distributor to
digitally sign the installers themselves.  This method is not 100%
reliable - nothing is - but at present it's the best method we have.
And note that it is already implemented in the Linux software repositories.




-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: OpenPGP digital signature
URL: <http://lists.cpunks.org/pipermail/cypherpunks/attachments/20170703/9939ff89/attachment.sig>