Why isn't HTTPS everywhere yet? • Hacker News Board

Re: Why isn't HTTPS everywhere yet?

#61

Post by drdaeman » Tue, Jan 19, 2016, 9:17 AM UTC

xroche wrote: post #60

"Why isn't HTTPS everywhere yet?": Because it makes absolutely no sense for the vast majority of online content. Email in https ? Sure. Reading news sites in https ? Accessing RFC in https ? My favorite online recipe site in https ? A total waste of money and CPU. Oh, and sure, the problem has been "solved" for few geeks using the latest browsers accepting let's encrypt certificates. Sure.

> Because it makes absolutely no sense for the vast majority of online content.

Hey, not so fast with conclusions, please.

Do you want an ISP filling your recipe reading with their advertisements. Nope? Or a random dude spoofing a Starbucks WiFi hotspot and serving you a malware on what you think is a trusted download site. Still no?

That's what TLS is for. Not for random paranoid geeks or "just email and online payments" security.

Oh, but, yes, Let's Encrypt is not yet completely production grade and still have some compatibility issues with older systems. Currently the only non-paid options I know are WoSign and StartSSL.

Re: Why isn't HTTPS everywhere yet?

#62

Post by drdaeman » Tue, Jan 19, 2016, 9:22 AM UTC

wodenokoto wrote: post #59

When I lived in China I was pretty happy the https movement hadn't won yet. Sites that forced me on a secure line were basically useless. The great firewall doesn't appreciate encrypted connections, and will usually grind to a halt, when deciding if it will let you get the content.

Isn't it the contrary. If Internet would be practically unavailable in China except for domestic resources, due to every single server using TLS for absolutely anything — would Great Firewall survive?

Re: Why isn't HTTPS everywhere yet?

#63

Post by [deleted] » Tue, Jan 19, 2016, 9:24 AM UTC

xroche wrote: post #60

"Why isn't HTTPS everywhere yet?": Because it makes absolutely no sense for the vast majority of online content. Email in https ? Sure. Reading news sites in https ? Accessing RFC in https ? My favorite online recipe site in https ? A total waste of money and CPU. Oh, and sure, the problem has been "solved" for few geeks using the latest browsers accepting let's encrypt certificates. Sure.

[deleted]

Re: Why isn't HTTPS everywhere yet?

#64

Post by drdaeman » Tue, Jan 19, 2016, 9:29 AM UTC

0_00_0 wrote: post #53

programminggeek wrote: post #46

Three obvious reasons... Cost to the end user $10-200/year - even more on Heroku($20/month). Configuration/Setup sucks - seriously you are supposed to run a bunch of unix commands, copy something to a server, and the whole process isn't user friendly. Limited end user benefit - A business owner and user up until recently hasn't thought much or cared much about information security outside of online purchases. Until i…

"Cost to the end user $10-200/year" What? How have you not heard of Let's Encrypt by now?

There are some issues that are still prevent using their certificates in production¹. For example this one prevents Windows XP clients (not just IE, but anything that uses system X.509 libraries) from connecting: https://github.com/letsencrypt/letsencrypt/issues/1660.

Still there's WoSign (free for everyone) and StartSSL (free for non-commercial use).

____

¹) Only where 3-5% of more obscure clients still matter.

Re: Why isn't HTTPS everywhere yet?

#65

Post by pdkl95 » Tue, Jan 19, 2016, 9:42 AM UTC

xroche wrote: post #60

"Why isn't HTTPS everywhere yet?": Because it makes absolutely no sense for the vast majority of online content. Email in https ? Sure. Reading news sites in https ? Accessing RFC in https ? My favorite online recipe site in https ? A total waste of money and CPU. Oh, and sure, the problem has been "solved" for few geeks using the latest browsers accepting let's encrypt certificates. Sure.

> Because it makes absolutely no sense for the vast majority of online content.

So you use postcards for most "the vast majority" of your snail (postal service) mail, right? Because envelopes[1] make "absolutely no sense"?

Besides the security issues that have already been mentioned of someone modifying the content as a MITM - something which ISPs are already doing[2] - this is really just another version of the "If you have nothing to hide..." falacy. You do have things to hide, because you shouldn't let every node that handles your traffic compile a database of your browsing activities.

[1] https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html

[2] e.g. "X-UIDH" and the various ISPs that inject javascript for various reasons.

Re: Why isn't HTTPS everywhere yet?

#66

Post by idunno246 » Tue, Jan 19, 2016, 9:43 AM UTC

Eridrus wrote: post #58

r1ch wrote: post #19

Still no mention about ads. Using HTTPS means you have to load ads over HTTPS and a huge number of ad networks are not reachable over HTTPS and another large number of assets / tags are hard coded to fetch HTTP resources. For any ad supported website, HTTPS will cause a significant loss of ad revenue. Given how long it's taking the industry to transition away from Flash I'm not holding my breath about this being fixe…

I'm surprised by this. Both Google and Amazon forced the adtech provider I work for to move to HTTPS and fix all the associated errors mid last year.

agreed, google forced us 100% https. i cant imagine theres that much difference in ad revenue anymore

Re: Why isn't HTTPS everywhere yet?

#67

Post by Ded7xSEoPKYNsDd » Tue, Jan 19, 2016, 9:47 AM UTC

hobarrera wrote: post #18

brians wrote: post #10

Earlier quoted context omitted.

Nope. The symmetric crypto is basically free. The asymmetric crypto is cheap. IPv4 addresses cost. Most big sites can't quite go SNI-only yet. Soon! Customer support costs. Why would TLS involve more customer support? Because it's a technology designed only to break connections. Ideally that's only the adversarial connections---but much like the TSA, a mis-designed authentication scheme can cause great stress and dra…

> IPv4 addresses cost. Most big sites can't quite go SNI-only yet. Soon! Why can't they go SNI? It's not like IE6 or netscape are relevant any more, is there some other issue?

You know how Mozilla recently had to delay the SHA1 deprecation in Firefox because it broke people behind shitty MITM "security" solutions? That crap often doesn't support any "modern" TLS features like SNI either.

See for example here: https://palant.de/2014/05/27/proxies-breaking-up-ssl-connect...

Re: Why isn't HTTPS everywhere yet?

#68

Post by kardos » Tue, Jan 19, 2016, 9:51 AM UTC

dangrossman wrote: post #20

hobarrera wrote: post #18

Earlier quoted context omitted.

> IPv4 addresses cost. Most big sites can't quite go SNI-only yet. Soon! Why can't they go SNI? It's not like IE6 or netscape are relevant any more, is there some other issue?

No SNI on Windows XP (IE6, IE7, IE8, Safari), nor Android 2.3 Browser, nor BlackBerry. Windows XP still has 4-5% usage share on the web, which is 1 in 20 people. Lots and lots of low-end and older Android handsets were on 2.3 because 4.0 had new hardware requirements. Combined, it's a relevant number of people for large sites.

> nor BlackBerry

Maybe not for the old blackberries, but SNI works on BB10.

Re: Why isn't HTTPS everywhere yet?

#69

Post by rplnt » Tue, Jan 19, 2016, 9:54 AM UTC

drdaeman wrote: post #61

xroche wrote: post #60

"Why isn't HTTPS everywhere yet?": Because it makes absolutely no sense for the vast majority of online content. Email in https ? Sure. Reading news sites in https ? Accessing RFC in https ? My favorite online recipe site in https ? A total waste of money and CPU. Oh, and sure, the problem has been "solved" for few geeks using the latest browsers accepting let's encrypt certificates. Sure.

> Because it makes absolutely no sense for the vast majority of online content. Hey, not so fast with conclusions, please. Do you want an ISP filling your recipe reading with their advertisements. Nope? Or a random dude spoofing a Starbucks WiFi hotspot and serving you a malware on what you think is a trusted download site. Still no? That's what TLS is for. Not for random paranoid geeks or "just email and online paym…

> Do you want an ISP filling your recipe reading with their advertisements.

Thought this would go in a direction where your ISP changes the ingredients :)

Re: Why isn't HTTPS everywhere yet?

#70

Post by pizzeys » Tue, Jan 19, 2016, 10:02 AM UTC

ac29 wrote: post #44

Zarel wrote: post #42

Earlier quoted context omitted.

It doesn't require a static IP; you can use SNI to use HTTPS on a shared IP: https://en.wikipedia.org/wiki/Server_Name_Indication SNI was already been mentioned an hour ago, too: https://news.ycombinator.com/item?id=10928036

Interesting, I hadn't heard of that. Perhaps I should make a correction -- on the webhost my small business uses, purchasing a static IP is required for SSL support. I was under the impression this was a technical limitation, but I was apparently wrong.

Shared webhost here: It's one of those complicated part-technical, part-user education issues.

Technical: SNI breaks older browsers (IE on XP, older mobiles). Also requires a modern (ish) OS on the server, if using CPanel, which like, every shared host in the world is pretty much.

User Education: Explaining exactly which clients will be broken is hard, etc.

#2 is basically gone now, because the users who would be broken are broken by the removal of SSLv3 and insecure crypto anyway - so we've now already killed them and can SNI without having to explain anything complicated to the user.