Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why isn't HTTPS everywhere yet?

webappsec-test.info

Post reply on HN
Print view View original

11–20 of 130 posts

Re: Why isn't HTTPS everywhere yet?

#11

Post by cmdrfred »

jkire wrote: post #5
Ecco wrote: post #4

I like the irony of that page being served over plain HTTP :-)

Ha! And HTTPS doesn't seem to work for me at all.

https://www.ssllabs.com/ssltest/analyze.html?d=http%3A%2F%2F...

    Assessment failed: No secure protocols supported
It fails spectacularly as well. No matter the quality of the content of this article (and I'm one to agree with it), this sort of throws it out the window for me. If you aren't able to manage a functioning version of the product you are describing (especially in the lets encrypt era) you don't get to do a technical article on said product.

Re: Why isn't HTTPS everywhere yet?

#12

Post by eknkc »

GeneticGenesis wrote: post #2

Another big blocker is cost. For example, one of the biggest CDNs in the world (I'm looking at you, Akamai), charge dramatically more for delivering content over HTTPS. Let's say you're delivering video content at scale, the difference between HTTP and HTTPS delivery can be many millions of dollars a year. But why not use a different CDN, say Cloudfront which prices the same for HTTP and HTTPS?, well, simple, the sam…

BTW, Cloudfront also prices HTTPS a little bit higher than HTTP (on per request pricing, not on bandwidth).

Re: Why isn't HTTPS everywhere yet?

#14

Post by kefka »

Im not able to use SSL certs on all my endpoints. I have to use self-signed certs. That's because many of my machines are on TOR hidden services.

The CA-CERT won't allow any certs for .onion unless you buy at exorbitant price an EV2 cert. And that especially means no free certs.

So I do use self-signed because I want end to end crypto (and the next-to node can see data). Of course my browsers throw a fit, but alas I am indeed secure.

... but I want an .onion cert authority by LetsEncrypt and first-class network routing for all .onion addresses in Linux via /etc/resolve.conf

Re: Why isn't HTTPS everywhere yet?

#17

Post by lindx »

jkire wrote: post #3
GeneticGenesis wrote: post #2

Another big blocker is cost. For example, one of the biggest CDNs in the world (I'm looking at you, Akamai), charge dramatically more for delivering content over HTTPS. Let's say you're delivering video content at scale, the difference between HTTP and HTTPS delivery can be many millions of dollars a year. But why not use a different CDN, say Cloudfront which prices the same for HTTP and HTTPS?, well, simple, the sam…

I'd imagine HTTPS is significantly more expensive to host than plain HTTP, due to the CPU requirements of the crypto involved.

With AES-NI, a single modern CPU core can encrypt 10 gigabits/second and do about 50,000 public key operations per second. Cryptography is not that expensive.

Re: Why isn't HTTPS everywhere yet?

#18

Post by hobarrera »

brians wrote: post #10
jkire wrote: post #3

Earlier quoted context omitted.

I'd imagine HTTPS is significantly more expensive to host than plain HTTP, due to the CPU requirements of the crypto involved.

Nope. The symmetric crypto is basically free. The asymmetric crypto is cheap. IPv4 addresses cost. Most big sites can't quite go SNI-only yet. Soon! Customer support costs. Why would TLS involve more customer support? Because it's a technology designed only to break connections. Ideally that's only the adversarial connections---but much like the TSA, a mis-designed authentication scheme can cause great stress and dra…

> IPv4 addresses cost. Most big sites can't quite go SNI-only yet. Soon!

Why can't they go SNI? It's not like IE6 or netscape are relevant any more, is there some other issue?

Re: Why isn't HTTPS everywhere yet?

#19

Post by r1ch »

Still no mention about ads. Using HTTPS means you have to load ads over HTTPS and a huge number of ad networks are not reachable over HTTPS and another large number of assets / tags are hard coded to fetch HTTP resources. For any ad supported website, HTTPS will cause a significant loss of ad revenue.

Given how long it's taking the industry to transition away from Flash I'm not holding my breath about this being fixed any time soon.

Re: Why isn't HTTPS everywhere yet?

#20

Post by dangrossman »

hobarrera wrote: post #18
brians wrote: post #10

Earlier quoted context omitted.

Nope. The symmetric crypto is basically free. The asymmetric crypto is cheap. IPv4 addresses cost. Most big sites can't quite go SNI-only yet. Soon! Customer support costs. Why would TLS involve more customer support? Because it's a technology designed only to break connections. Ideally that's only the adversarial connections---but much like the TSA, a mis-designed authentication scheme can cause great stress and dra…

> IPv4 addresses cost. Most big sites can't quite go SNI-only yet. Soon! Why can't they go SNI? It's not like IE6 or netscape are relevant any more, is there some other issue?

No SNI on Windows XP (IE6, IE7, IE8, Safari), nor Android 2.3 Browser, nor BlackBerry. Windows XP still has 4-5% usage share on the web, which is 1 in 20 people. Lots and lots of low-end and older Android handsets were on 2.3 because 4.0 had new hardware requirements. Combined, it's a relevant number of people for large sites.
Post reply on HN