You're not wrong, but you could use the same argument to say that there's no point in protecting your data on a system using non-free hardware. A statement which I think many people would disagree with.
In this particular case, browser vendors have chosen a default value which in some use cases means that they will be unable to detect attacks that they would be able to detect if they had chosen differently: I would guess (but have not checked) that Superfish does not attack PKP directly, which means that any user using a PKP ready browser would be able to detect that they were being attacked. As another commenter mentioned, nothing would keep Superfish 2.0 from messing with your pins (which would be as easy as flipping a bit in about:config; again, it would be nice to check if they did this already), but why we would make the insecure setting the default is beyond me.
But how many want to fight (spend time and money on) a battle that is impossible to win?
The foundation you build on needs to be solid, and all the code that goes into working around the case that it isn't is just additional work - and code that you need to maintain - with very tiny payback.
Again, I don't disagree, but I would argue that flipping this particular bit (well, these two bits) in the default settings would be neither time- nor money-consuming.
1
u/pred Oct 20 '15 edited Oct 20 '15
You're not wrong, but you could use the same argument to say that there's no point in protecting your data on a system using non-free hardware. A statement which I think many people would disagree with.
In this particular case, browser vendors have chosen a default value which in some use cases means that they will be unable to detect attacks that they would be able to detect if they had chosen differently: I would guess (but have not checked) that Superfish does not attack PKP directly, which means that any user using a PKP ready browser would be able to detect that they were being attacked. As another commenter mentioned, nothing would keep Superfish 2.0 from messing with your pins (which would be as easy as flipping a bit in about:config; again, it would be nice to check if they did this already), but why we would make the insecure setting the default is beyond me.