On Wed, Aug 06, 2014 at 12:35:42PM -0400, der Mouse wrote:
[...] (On at least two occasions I've looked at
adding
HTTPS support to the lynx I use, and in each case I've gotten some four
or five levels deep in yak shaving before discovering I needed
something ridiculously heavyweight for the purpose, like perl.
Debian's lynx(1) supports SSL out of the box:
abuse at mooli:~$ lynx -dump
http://duckduckgo.com
#[1]DuckDuckGo (Lite)
DuckDuckGo
________________________________________ Quack
References
1.
https://duckduckgo.com/opensearch_lite.xml
abuse at mooli:~$ lynx -version
Lynx Version 2.8.8dev.12 (22 Feb 2012)
libwww-FM 2.14, SSL-MM 1.4.1, GNUTLS 2.12.18, ncurses 5.9.20110404(wide)
Built on linux-gnu Mar 25 2012 22:14:49
Copyrights held by the Lynx Developers Group,
the University of Kansas, CERN, and other contributors.
Distributed under the GNU General Public License (Version 2).
See
http://lynx.isc.org/ and the online help for more information.
Someday I may try to find enough documentation to
build my own implementation
which doesn't depend on crap like that, but so far every time I've looked
I've rapidly ended up at pay-to-play "standards", which I of course
consider
completely unacceptable - indeed, I think the IETF should never have let
HTTPS in the door until that was fixed.)
If you're looking to implement the actual crypto, you're doing it wrong. It's
a
fairly major endeavour and very easy to make critical mistakes that ruin the
crypto. Fortunately, experts have alrady done the work and packaged it into
libraries for you to use. You will observe that lynx uses the GNUTLS library.
Anyway, AFAICS, all of the sailient details are right there in the RFCs or
other public domain sources for anybody who still wants to go ahead and write
their own implementation.
TLS is also fundamentally broken, in that what
security it provides depends
critically on the CA hierarchy, which is laughably broken. (Consider the
number of non-Microsoft entities which have obtained certs for
microsoft.com
- or the wildcard certs used to do things like HTTPS snooping at national
borders, the existence of even one of which is a fundamental subversion of
the trust model.)
TLS is certainly trivially vulnerable to MITM by anybody who can get a
certificate issued by a CA your browser trusts, but that's still a relatively
high bar. It protects against passive network sniffing, which is the most
common threat, especially now Wifi is so heavily-used.
There is the "Certificate Patrol" for Firefox that flags up strange changes of
certificate that might be indicative of a MITM attack. I've yet to see anything
but false positives, although this would likely be different if I was living in
a repressive regime that actually understood technology.