Chapter 33. HTTPS Sucks; Let's Kill It!

It's almost impossible to deploy SSL (and its successor, TLS) in a way that leaves everybody actually secure. SSL is great at providing a false sense of security, and not too much else. But, HTTPS (which is a variation of the HTTP protocol that enforces the use of SSL) is even worse, because it is impossible to protect everybody with it.

First, let's look at applications built using SSL. With most APIs, you can connect easily, with very little code, but the connection isn't validated. You just connect, and you have no idea who you're talking to. The server has even less idea. Usually you do some sort of login jig after that, but there's no guarantee that someone isn't sitting in the middle.