Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why isn't HTTPS everywhere yet?

webappsec-test.info

Post reply on HN
Print view View original

31–40 of 130 posts

Re: Why isn't HTTPS everywhere yet?

#31

Post by IceyEC »

Integer wrote: post #22
kefka wrote: post #14

Im not able to use SSL certs on all my endpoints. I have to use self-signed certs. That's because many of my machines are on TOR hidden services. The CA-CERT won't allow any certs for .onion unless you buy at exorbitant price an EV2 cert. And that especially means no free certs. So I do use self-signed because I want end to end crypto (and the next-to node can see data). Of course my browsers throw a fit, but alas I…

I always thought .onion sites are end to end encrypted. "The rendezvous point simply relays (end-to-end encrypted) messages from client to service and vice versa." according to https://www.torproject.org/docs/hidden-services.html.en There's even a ticket to add a padlock to indicate this in TOR Browser https://trac.torproject.org/projects/tor/ticket/8686

This is correct, hidden services are fully encrypted from the users browser to the tor relay running the hidden service

Re: Why isn't HTTPS everywhere yet?

#32

Post by lindx »

manigandham wrote: post #28
r1ch wrote: post #19

Still no mention about ads. Using HTTPS means you have to load ads over HTTPS and a huge number of ad networks are not reachable over HTTPS and another large number of assets / tags are hard coded to fetch HTTP resources. For any ad supported website, HTTPS will cause a significant loss of ad revenue. Given how long it's taking the industry to transition away from Flash I'm not holding my breath about this being fixe…

This is a big reason. Unfortunately the industry is full of old and/or poor tech that is already fragile as it is. All modern ad networks (like ours) are completely HTTPS ready but the transition will be slow due to momentum with existing vendors.

Solution: block HTTP ads.

Re: Why isn't HTTPS everywhere yet?

#34

Post by kefka »

Integer wrote: post #22
kefka wrote: post #14

Im not able to use SSL certs on all my endpoints. I have to use self-signed certs. That's because many of my machines are on TOR hidden services. The CA-CERT won't allow any certs for .onion unless you buy at exorbitant price an EV2 cert. And that especially means no free certs. So I do use self-signed because I want end to end crypto (and the next-to node can see data). Of course my browsers throw a fit, but alas I…

I always thought .onion sites are end to end encrypted. "The rendezvous point simply relays (end-to-end encrypted) messages from client to service and vice versa." according to https://www.torproject.org/docs/hidden-services.html.en There's even a ticket to add a padlock to indicate this in TOR Browser https://trac.torproject.org/projects/tor/ticket/8686

My understanding was that the connection prior saw the cleartext of the final destination's packets.

SSL was the way to make sure that end to end was encrypted so that nobody could read the data (mainly login/password info).

I think the only way to see is to be part of the tunnel architecture and see if my thoughts are right or wrong.

Re: Why isn't HTTPS everywhere yet?

#35

Post by manigandham »

lindx wrote: post #32
manigandham wrote: post #28

Earlier quoted context omitted.

This is a big reason. Unfortunately the industry is full of old and/or poor tech that is already fragile as it is. All modern ad networks (like ours) are completely HTTPS ready but the transition will be slow due to momentum with existing vendors.

Solution: block HTTP ads.

Solution to what? Publishers still have to enable HTTPS on their sites and they'll only do that once all the resources on the page are HTTPS compatible.

Re: Why isn't HTTPS everywhere yet?

#36

Post by pfg »

kefka wrote: post #34
Integer wrote: post #22

Earlier quoted context omitted.

I always thought .onion sites are end to end encrypted. "The rendezvous point simply relays (end-to-end encrypted) messages from client to service and vice versa." according to https://www.torproject.org/docs/hidden-services.html.en There's even a ticket to add a padlock to indicate this in TOR Browser https://trac.torproject.org/projects/tor/ticket/8686

My understanding was that the connection prior saw the cleartext of the final destination's packets. SSL was the way to make sure that end to end was encrypted so that nobody could read the data (mainly login/password info). I think the only way to see is to be part of the tunnel architecture and see if my thoughts are right or wrong.

What you're saying is correct for connections from tor to cleartext sites. Hidden services are end-to-end encrypted. I'm not sure which cipher tor uses; maybe modern browsers are better in that respect.

Re: Why isn't HTTPS everywhere yet?

#37

Post by Zarel »

In addition to ad revenue issue r1ch mentioned (a friend of mine told me HTTPS ads provided less than half the revenue HTTP ads provide), there are a few other things I've encountered while working on HTTPS support:

- More ad network misbehavior: the last time I checked, a lot of HTTPS ads on AdSense would take up 100% CPU and lag the browser, because it would try to request an HTTP resource and fail in an infinite loop

- More failed connections: just two weeks ago, a Firefox update made HTTPS sites inaccessible on computers with certain HTTPS-scanning antiviruses installed: https://news.ycombinator.com/item?id=10854629

- Browser bugs: Chrome doesn't let you HTML5-drag-and-drop data-URIs from HTTPS: https://github.com/Zarel/Pokemon-Showdown-Client/commit/53a1....

- Warnings when embedding HTTP images: Users often embed HTTP images in community sites like forums, chatrooms, etc, which cause warnings in Firefox and make Chrome remove its "secure" designators

- Annoyance: I tried to get a Let's Encrypt certificate recently. My server runs Node, and it doesn't serve arbitrary files from a directory (it's a WebSocket server) so the webroot method wasn't possible, so I actually had to stop the server and reconfigure the firewall not to redirect ports 80 and 443 to get the certificate.

`letsencrypt-auto` also gives very cryptic error messages: apparently "Correct zName not found for TLS SNI challenge. Found" means "please use `sudo -H`". And the standalone verification failed for an unknown reason, but at least I eventually got the Apache verification working. And I'm going to have to go through all this again in three months...

Re: Why isn't HTTPS everywhere yet?

#38

Post by thehairyone »

unethical_ban wrote: post #24
thehairyone wrote: post #21

Earlier quoted context omitted.

No, it doesn't. Lets Encrypt certs are equivalent to self-signed certs. No hassle ==> broken shit.

No, you are incorrect. At the moment, their certs are cross-signed, and I have tested my site with multiple browsers. It works.

The cross sign is too far up the chain.

If you cross sign a self-signed cert what do you get?

A Let's Encrypt Cert.

Domain Ownership is not the same as file ownership.

Re: Why isn't HTTPS everywhere yet?

#39

Post by thehairyone »

ceejayoz wrote: post #27
thehairyone wrote: post #21

Earlier quoted context omitted.

No, it doesn't. Lets Encrypt certs are equivalent to self-signed certs. No hassle ==> broken shit.

> Lets Encrypt certs are equivalent to self-signed certs. This is entirely false.

Oh yeah! sure...

what exactly ensures that the DV cert is a DV cert?

Re: Why isn't HTTPS everywhere yet?

#40

Post by ac29 »

Something that no one has seemed to mention: it doesn't work on shared hosting, it requires a static IP. For small sites, the additional cost of moving to a plan that supports SSL and has a static IP, this could be a big cost.
Post reply on HN