Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why isn't HTTPS everywhere yet?

webappsec-test.info

Post reply on HN
Print view View original

91–100 of 130 posts

Re: Why isn't HTTPS everywhere yet?

#91

Post by dale-cooper »

hobarrera wrote: post #18
brians wrote: post #10

Earlier quoted context omitted.

Nope. The symmetric crypto is basically free. The asymmetric crypto is cheap. IPv4 addresses cost. Most big sites can't quite go SNI-only yet. Soon! Customer support costs. Why would TLS involve more customer support? Because it's a technology designed only to break connections. Ideally that's only the adversarial connections---but much like the TSA, a mis-designed authentication scheme can cause great stress and dra…

> IPv4 addresses cost. Most big sites can't quite go SNI-only yet. Soon! Why can't they go SNI? It's not like IE6 or netscape are relevant any more, is there some other issue?

Chromecast for example does not support SNI, which is crazy.

Re: Why isn't HTTPS everywhere yet?

#92

Post by lucaspiller »

cm2187 wrote: post #85
grey-area wrote: post #82

Earlier quoted context omitted.

It can be as simple as that. I just set up a site a few days ago with caddy - http://caddyserver.com . Getting certs for multiple domains was a matter of adding a single line for tls to the config, it generates a key locally, requests the cert, and installs it transparently on the first request. Pretty smooth. I hope they will autorenew without intervention, haven't tested that bit yet, but so far it was painless. I…

I'll look into it, but to illustrate my point, when clicking on your link I get an invalid certificate error in chrome. Granted I am using an old browser (Win XP / Chrome 40) but it illustrates my point that it is hard to get SSL to work well.

Why is your employer forcing to use a severely outdated system? Do you often come across broken or very slow websites (I imagine the hardware is from the same era as the OS)?

Re: Why isn't HTTPS everywhere yet?

#93

Post by angry-hacker »

manigandham wrote: post #28
r1ch wrote: post #19

Still no mention about ads. Using HTTPS means you have to load ads over HTTPS and a huge number of ad networks are not reachable over HTTPS and another large number of assets / tags are hard coded to fetch HTTP resources. For any ad supported website, HTTPS will cause a significant loss of ad revenue. Given how long it's taking the industry to transition away from Flash I'm not holding my breath about this being fixe…

This is a big reason. Unfortunately the industry is full of old and/or poor tech that is already fragile as it is. All modern ad networks (like ours) are completely HTTPS ready but the transition will be slow due to momentum with existing vendors.

Well, even Amazon (affiliate) ads server their image over http. So for whatever reason, even the owner of AWS can't serve their ads over https.

Do you need to use their widgets in the first place is another question.

Re: Why isn't HTTPS everywhere yet?

#94

Post by angry-hacker »

Zarel wrote: post #42
ac29 wrote: post #40

Something that no one has seemed to mention: it doesn't work on shared hosting, it requires a static IP. For small sites, the additional cost of moving to a plan that supports SSL and has a static IP, this could be a big cost.

It doesn't require a static IP; you can use SNI to use HTTPS on a shared IP: https://en.wikipedia.org/wiki/Server_Name_Indication SNI was already been mentioned an hour ago, too: https://news.ycombinator.com/item?id=10928036

SNI breaks soo many things. A lot of RSS readers, for an example saving to pocket won't work. Bing (at least few months ago) didn't know how to index sites using HTTPS+SNI. You had to e-mail them manually, so they can whitelist your site. Probably let some crawlers than know how to handle SNI index your site instead of default ones.

There are so many services that have problems with SNI. For an example MailChimp RSS to E-mail. They use W3C Feed Validation Service, that's why it breaks it, it won't let you past it since you can't validate the feed. Reddit thumbnails/suggest title feature is broken.

I can list 100 other services that break with SNI; it's a pain in the ass. And I'm not talking about users with old browser.

I jumped on the Google's HTTPS everything train and but by the look of it - it was a bad decision. I'm using SNI+HTTPS for over a year now for a fairly popular static site/blog. 500.000 users per month. The ironic thing is that I have no complaints from users, but plenty of tech fails. The hip startups such as Pocket or RSS readers. The users are better prepared for HTTPS everywhere than the tech people, who should have know better.

I don't need an IP address for every (static) site I own. I have one VPS and I happily serve 6 (or 100) static sites and I just want to use SNI and give HTTPS to users, but I can't.

---------

EDIT: Am I the only person who thinks support of SNI is necessary to HTTPS everywhere to succeed or am I a lonely wolf?

Re: Why isn't HTTPS everywhere yet?

#95

Post by mahouse »

duskwuff wrote: post #9
thehairyone wrote: post #6

a2enmod headers echo -e "ServerSignature Off\nServerTokens Prod" >> /etc/apache2/apache2.conf /etc/init.d/apache2 restart openssl req -new -nodes -keyout webappsec-test.info.key -out webappsec-test.info.csr -newkey rsa:2048 cat webappsec-test.info.csr Register here: https://www.startssl.com/ Copy and paste csr... cat Domain_cert.pem CA_root.pem https://mozilla.github.io/server-side-tls/ssl-config-generat... ====> A+…

Why use StartSSL, when Let's Encrypt will give you an equally good certificate (with more flexibility on SANs!) with less hassle?

Less hassle? You have to renew it every a few months.

Re: Why isn't HTTPS everywhere yet?

#96

Post by ascorbic »

mahouse wrote: post #95
duskwuff wrote: post #9

Earlier quoted context omitted.

Why use StartSSL, when Let's Encrypt will give you an equally good certificate (with more flexibility on SANs!) with less hassle?

Less hassle? You have to renew it every a few months.

You're supposed to renew them automatically from a monthly cron job.

Re: Why isn't HTTPS everywhere yet?

#97

Post by cm2187 »

lucaspiller wrote: post #92
cm2187 wrote: post #85

Earlier quoted context omitted.

I'll look into it, but to illustrate my point, when clicking on your link I get an invalid certificate error in chrome. Granted I am using an old browser (Win XP / Chrome 40) but it illustrates my point that it is hard to get SSL to work well.

Why is your employer forcing to use a severely outdated system? Do you often come across broken or very slow websites (I imagine the hardware is from the same era as the OS)?

Hardware is high end 2009 workstations.

We as an organisation like to take our time. We wouldn't welcome a new joiner with a PC on his desk. Much more fun to see him struggling for weeks with our internal IT approval processes. We happily pay millions to Microsoft to get the privilege of using Windows Xp / 32 bit systems a little bit longer (I have now almost more RAM in my mobile phone than my workstation). In fact I suspect many of the critical infrastructures of the organisation are running on COBOL. We'd probably still use CRT screens if our IT department could source them. We are certainly still using blackberries (I hope they will stash enough devices before RIM goes bust).

Re: Why isn't HTTPS everywhere yet?

#99

Post by zbuf »

dTal wrote: post #56

I'm not convinced it's even a great idea until something is done about a) the entirely broken CA trust model or b) mainstream web browser's entirely broken attitude to that trust model.

I am interested in (a). Recently I heard from a trusted source who works for a popular CDN that some top levels CAs, who are trusted in my browser, are known to be issuing certificates for domains which they have no authority to be doing so, for the purpose of man-in-the-middle analysis by certain parties. But that there is a reluctance to pull these certificates because that would be like switching off portions of the web.

Is there any truth or more solid reference to this from those who are in the industry and know more about these topics? Rather alarming if so.

Re: Why isn't HTTPS everywhere yet?

#100

Post by notfoss »

bobfunk wrote: post #33

We just launched support for free SSL on all our plans at https://www.netlify.com , doing what we can to help getting HTTPS everywhere. Won't help on mixed content or broken ad providers, but at least give people a place to put a project on a custom domain for free with HTTPS :)

What is the Full SSL feature offered by you? From what I understand it means supporting weaker ciphers apart from SSL and older TLS versions. Is that the case?
Post reply on HN