Repository navigation
More emphasis on integrity? #80
Description
Standardizing on HTTPS only is great, but I imagine one common reaction by some agencies will be, "we only serve static content, so there are minimal privacy issues." While serving up static content can have some privacy implications (e.g. looking up medical information from the CDC), an under-appreciated benefit of HTTPS is that it ensures the integrity of information in transit. It's conceivable that an adversary would want to tamper with content being served. For example, a potentially hostile country could silently modify published US policy when viewed by their citizens. In a less extreme example, an ISP could inject additional content (such as ads) into a page, causing users to think that agencies added or endorsed that content.
While some agencies already use technology to ensure integrity (in particular, GPO's cryptographic signing of PDFs comes to mind), HTTPS transparently and automatically adds another layer of protection.
Activity
pwnall commentedon Mar 18, 2015
I agree. Citing from the current proposal:
As an example, I'd think that embassy sites would be great targets for MITM attacks, as they describe visa procedures and the fee payment process.
konklone commentedon Mar 19, 2015
I think the closest thing we have to this is here:
Which covers authenticity and confidentiality, but not integrity. This is a good point to raise, thank you.