Technology

59217 readers

2607 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

[email protected]

277

"No, seriously. All those things Google couldn't find anymore? Top of the search pile. Queries that generated pages of spam in Google results? Fucking pristine on Kagi – the right answers, over and ov (pluralistic.net)

submitted 7 months ago by [email protected] to c/[email protected]

112 comments fedilink hide all child comments

cross-posted from: https://lemmy.ml/post/14100831

"No, seriously. All those things Google couldn't find anymore? Top of the search pile. Queries that generated pages of spam in Google results? Fucking pristine on Kagi – the right answers, over and ov

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 36 points 7 months ago (2 children)

They've stubbornly not gotten an SSL because they transact 0 data beyond band name searches.

Even if sites do not store user account data, such as passwords, ALL websites, and I mean ALL, handle user data, because merely accessing pages (urls) is user data.

Stubbornness is not a good reason not to setup SSL. Encryption should always be on, all the time, for everything.

[–] [email protected] 14 points 7 months ago* (last edited 7 months ago) (1 children)

And it's not only about user data, it would also expose the website to content spoofing in public wifi, which would for example allow the attacker to inject fishing content in the website.

SSL encrypts the data you're sending but it also ensures that you're communicating only with who you think you are. Without SSL you can't be confident about any of that.

[–] [email protected] 1 points 7 months ago (1 children)

If a website has literally no login system, there's nothing to phish.

There is honestly no reason to use SSL on a static website that has no login system and just displays some content.

IE a static blog or etc, where the only content on the website is just "look at this stuff, okay thank you!"

[–] [email protected] 1 points 7 months ago

That's still my point, for example you could inject your own login system "create an account to keep track of your favorite artists, or some new shiny feature". For there you can get people's personal information, potentially a password they use on other services.

An URL is something the general public will trust, if the content can be messed with you repurpose the website's reputation. I took phishing as an example but even my not-so-creative and non-expert brain can think of other things : asking for donations, propaganda, advertising, censorship, ...

[–] [email protected] -4 points 7 months ago (2 children)

Ssl doest hide the url you're visiting

[–] [email protected] 17 points 7 months ago (1 children)

It does. Anyone sniffing the traffic can only see the domain.

[–] [email protected] 0 points 7 months ago

Not if you use DNSSEC.

[–] [email protected] 6 points 7 months ago (1 children)

Yes it does. You can derive the domain from snooping DNS lookups but the URL is part of the encrypted get header.

[–] [email protected] 7 points 7 months ago (1 children)

The domain is a public part of TLS itself, SNI, for now.

[–] [email protected] 1 points 7 months ago

Yeah we're need encrypted SNI. I hear it's coming soon.