Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why isn't HTTPS everywhere yet?

webappsec-test.info

Post reply on HN
Print view View original

81–90 of 130 posts

Re: Why isn't HTTPS everywhere yet?

#81

Post by dgoldstein0 »

hobarrera wrote: post #18
brians wrote: post #10

Earlier quoted context omitted.

Nope. The symmetric crypto is basically free. The asymmetric crypto is cheap. IPv4 addresses cost. Most big sites can't quite go SNI-only yet. Soon! Customer support costs. Why would TLS involve more customer support? Because it's a technology designed only to break connections. Ideally that's only the adversarial connections---but much like the TSA, a mis-designed authentication scheme can cause great stress and dra…

> IPv4 addresses cost. Most big sites can't quite go SNI-only yet. Soon! Why can't they go SNI? It's not like IE6 or netscape are relevant any more, is there some other issue?

some pretty modern languages / libraries don't have SNI built in. E.g. requests under python 2.7 doesn't do it by default. As for browsers, I think the answer is that most do - it ends up being something like IE on XP and really old Android that gives you trouble.

Re: Why isn't HTTPS everywhere yet?

#82

Post by grey-area »

cm2187 wrote: post #74

Cost is going to be taken care of by let's encrypt. I am surprised complexity of setting up SSL isn't mentioned in the article. First the tools are complex to use, use various formats for storing keys that are incompatible. In Linux you pretty much have to rely on cryptic command lines. Windows is slightly simpler. And you need more tools to convert certificates between the different formats (for instance using an II…

It can be as simple as that.

I just set up a site a few days ago with caddy - http://caddyserver.com. Getting certs for multiple domains was a matter of adding a single line for tls to the config, it generates a key locally, requests the cert, and installs it transparently on the first request. Pretty smooth. I hope they will autorenew without intervention, haven't tested that bit yet, but so far it was painless.

I imagine most mainstream servers will incorporate this sort of smooth tls flow at some point now that services like letsencrypt are available to base it on. I'm considering moving web server for other sites (usually use nginx) for this single feature.

Re: Why isn't HTTPS everywhere yet?

#83

Post by ck2 »

Because many websites are ad supported and few ad networks have https ads ready and configured properly, so they do not display.

Even on adsense, inventory drops for a https-only website.

Re: Why isn't HTTPS everywhere yet?

#84

Post by Loic »

cm2187 wrote: post #74

Cost is going to be taken care of by let's encrypt. I am surprised complexity of setting up SSL isn't mentioned in the article. First the tools are complex to use, use various formats for storing keys that are incompatible. In Linux you pretty much have to rely on cryptic command lines. Windows is slightly simpler. And you need more tools to convert certificates between the different formats (for instance using an II…

The cipher list is effectively a big issue. When using the good old Sun Fortran compiler, I was used to have a -fast flag which would be smart to detect the hardware and be as fast as possible while respecting the IEEE maths (as far as I can remember).

I would love a -secure flag to just use the most secure option of the current version of the software even at the cost of X years of backward compatibility at the tool/client/browser level.

For example for nginx instead of something like:

    ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS;
You would get:

    ssl_ciphers SECURE;

Re: Why isn't HTTPS everywhere yet?

#85

Post by cm2187 »

grey-area wrote: post #82
cm2187 wrote: post #74

Cost is going to be taken care of by let's encrypt. I am surprised complexity of setting up SSL isn't mentioned in the article. First the tools are complex to use, use various formats for storing keys that are incompatible. In Linux you pretty much have to rely on cryptic command lines. Windows is slightly simpler. And you need more tools to convert certificates between the different formats (for instance using an II…

It can be as simple as that. I just set up a site a few days ago with caddy - http://caddyserver.com . Getting certs for multiple domains was a matter of adding a single line for tls to the config, it generates a key locally, requests the cert, and installs it transparently on the first request. Pretty smooth. I hope they will autorenew without intervention, haven't tested that bit yet, but so far it was painless. I…

I'll look into it, but to illustrate my point, when clicking on your link I get an invalid certificate error in chrome. Granted I am using an old browser (Win XP / Chrome 40) but it illustrates my point that it is hard to get SSL to work well.

Re: Why isn't HTTPS everywhere yet?

#86

Post by pmlnr »

manigandham wrote: post #35
lindx wrote: post #32

Earlier quoted context omitted.

Solution: block HTTP ads.

Solution to what? Publishers still have to enable HTTPS on their sites and they'll only do that once all the resources on the page are HTTPS compatible.

To this: http://idlewords.com/talks/website_obesity.htm

Re: Why isn't HTTPS everywhere yet?

#87

Post by cm2187 »

Loic wrote: post #84
cm2187 wrote: post #74

Cost is going to be taken care of by let's encrypt. I am surprised complexity of setting up SSL isn't mentioned in the article. First the tools are complex to use, use various formats for storing keys that are incompatible. In Linux you pretty much have to rely on cryptic command lines. Windows is slightly simpler. And you need more tools to convert certificates between the different formats (for instance using an II…

The cipher list is effectively a big issue. When using the good old Sun Fortran compiler, I was used to have a -fast flag which would be smart to detect the hardware and be as fast as possible while respecting the IEEE maths (as far as I can remember). I would love a -secure flag to just use the most secure option of the current version of the software even at the cost of X years of backward compatibility at the tool…

Or they should package it in vestions. "TLS 1.3" would come with a standard list of ciphers and other parameters. All you would have to do is tell your system "Disable SSL3.0" "Enable TLS 1.3", etc.

Right now it feels like trying to fly a B747.

Re: Why isn't HTTPS everywhere yet?

#89

Post by grey-area »

cm2187 wrote: post #85
grey-area wrote: post #82

Earlier quoted context omitted.

It can be as simple as that. I just set up a site a few days ago with caddy - http://caddyserver.com . Getting certs for multiple domains was a matter of adding a single line for tls to the config, it generates a key locally, requests the cert, and installs it transparently on the first request. Pretty smooth. I hope they will autorenew without intervention, haven't tested that bit yet, but so far it was painless. I…

I'll look into it, but to illustrate my point, when clicking on your link I get an invalid certificate error in chrome. Granted I am using an old browser (Win XP / Chrome 40) but it illustrates my point that it is hard to get SSL to work well.

Wasn't XP EOL in 2014 or something after being unsupported since 2009? That's long enough ago that many websites don't test on XP any more, or even work (like sites which require SNI AFAIK). I'm happy to drop XP users I'm afraid, given it has been unsupported for some time (I understand some workplaces mandate it still).

Re: Why isn't HTTPS everywhere yet?

#90

Post by cm2187 »

grey-area wrote: post #89
cm2187 wrote: post #85

Earlier quoted context omitted.

I'll look into it, but to illustrate my point, when clicking on your link I get an invalid certificate error in chrome. Granted I am using an old browser (Win XP / Chrome 40) but it illustrates my point that it is hard to get SSL to work well.

Wasn't XP EOL in 2014 or something after being unsupported since 2009? That's long enough ago that many websites don't test on XP any more, or even work (like sites which require SNI AFAIK). I'm happy to drop XP users I'm afraid, given it has been unsupported for some time (I understand some workplaces mandate it still).

As you suggest, I am not using XP by choice...
Post reply on HN