Surely you understand that there are different types of "privacy":
- things that only you know (that aren't sent anywhere and maybe even are encrypted at rest)
- things that only a set of trusted parties are supposed to know
The latter is what HTTPS allows you to achieve, alongside making it so that there's no possibility of a "man in the middle", which could not only read the contents of your request, but also alter it (or do the same for the server side response). OTP, TOTP and JWT are lovely for authentication, but they do not address the above concerns, as pointed out by the poster that you're replying to, before discarding your own argument.
Suppose that you have no encryption but have the best authentication system in the world. What's to prevent some hacker from setting themselves up in the middle between you and the e-commerce site that you're on and messing with requests however they please, showing both you and the site what they want you to see? You tried to buy an HDD for 50$? They just bought themselves a laptop for 500$.
The fact that there's a very secure bit of information somewhere in the request does not protect you from the rest of JSON being changed to say whatever they want it to (unless you are signing the contents of every request, but at that point you're reinventing HTTPS in some capacity). Or even the fact that they could set themselves up in the middle, presenting themselves as you to the site and presenting themselves as the site to you, albeit with more effort.
Of course, an e-commerce site is a silly example, but what about you receiving a bill that tells you to send money to a different account than you should? What would your banking site look like without encryption? Is your suggestiong for no one to do online banking because "nothing is private", even though we already have HTTPS which addresses this very issue ALONGSIDE various authentication methods?
Comments
You've reduced your own argument to a non-answer.
Surely you understand that there are different types of "privacy":
The latter is what HTTPS allows you to achieve, alongside making it so that there's no possibility of a "man in the middle", which could not only read the contents of your request, but also alter it (or do the same for the server side response). OTP, TOTP and JWT are lovely for authentication, but they do not address the above concerns, as pointed out by the poster that you're replying to, before discarding your own argument.Suppose that you have no encryption but have the best authentication system in the world. What's to prevent some hacker from setting themselves up in the middle between you and the e-commerce site that you're on and messing with requests however they please, showing both you and the site what they want you to see? You tried to buy an HDD for 50$? They just bought themselves a laptop for 500$.
The fact that there's a very secure bit of information somewhere in the request does not protect you from the rest of JSON being changed to say whatever they want it to (unless you are signing the contents of every request, but at that point you're reinventing HTTPS in some capacity). Or even the fact that they could set themselves up in the middle, presenting themselves as you to the site and presenting themselves as the site to you, albeit with more effort.
Of course, an e-commerce site is a silly example, but what about you receiving a bill that tells you to send money to a different account than you should? What would your banking site look like without encryption? Is your suggestiong for no one to do online banking because "nothing is private", even though we already have HTTPS which addresses this very issue ALONGSIDE various authentication methods?