Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why isn't HTTPS everywhere yet?

webappsec-test.info

Post reply on HN
Print view View original

111–120 of 130 posts

Re: Why isn't HTTPS everywhere yet?

#111

Post by feld »

zbuf wrote: post #99
dTal wrote: post #56

I'm not convinced it's even a great idea until something is done about a) the entirely broken CA trust model or b) mainstream web browser's entirely broken attitude to that trust model.

I am interested in (a). Recently I heard from a trusted source who works for a popular CDN that some top levels CAs, who are trusted in my browser, are known to be issuing certificates for domains which they have no authority to be doing so, for the purpose of man-in-the-middle analysis by certain parties. But that there is a reluctance to pull these certificates because that would be like switching off portions of t…

Yes, there's truth in it. It's takes time for them to be caught and punished, and the Certificate Transparency effort will make it much more difficult for these scumbags to do so.

Re: Why isn't HTTPS everywhere yet?

#112

Post by majewsky »

Zarel wrote: post #37

In addition to ad revenue issue r1ch mentioned (a friend of mine told me HTTPS ads provided less than half the revenue HTTP ads provide), there are a few other things I've encountered while working on HTTPS support: - More ad network misbehavior: the last time I checked, a lot of HTTPS ads on AdSense would take up 100% CPU and lag the browser, because it would try to request an HTTP resource and fail in an infinite l…

Regarding the "Annoyance" bullet point, you might have a better time if you put an Apache or nginx in the front (on ports 80/443), have it serve the acme-challenges statically and proxy_pass everything else to Node running on a high port. TLS handling would then happen in the frontend server only.

Regarding the "please use sudo" issue, it's very much possible to run the letsencrypt client as a non-root user if you set your filesystem permissions carefully. Here's the letsencrypt configuration for a private webserver of mine: https://github.com/majewsky/system-configuration/blob/master...

Re: Why isn't HTTPS everywhere yet?

#113

Post by stealthyb »

brians wrote: post #105
cm2187 wrote: post #87

Earlier quoted context omitted.

Or they should package it in vestions. "TLS 1.3" would come with a standard list of ciphers and other parameters. All you would have to do is tell your system "Disable SSL3.0" "Enable TLS 1.3", etc. Right now it feels like trying to fly a B747.

That does happen! Enable TLS 1.2 only and you're in pretty good shape. TLS 1.3 will drop more bad stuff and add a bit more good stuff.

It definitely helps, but if you're trying to keep up with the latest security, you'd be susceptible to Logjam (due to DHE-supporting ciphers in the default TLS 1.2 list).

There's the Mozilla SSL Configuration Generator which helps with the madness, but they still aren't keeping up with the latest recommendations.

Re: Why isn't HTTPS everywhere yet?

#114

Post by otterley »

lindx wrote: post #17
jkire wrote: post #3

Earlier quoted context omitted.

I'd imagine HTTPS is significantly more expensive to host than plain HTTP, due to the CPU requirements of the crypto involved.

With AES-NI, a single modern CPU core can encrypt 10 gigabits/second and do about 50,000 public key operations per second. Cryptography is not that expensive.

AES isn't the only algorithm used in TLS handshakes.

Re: Why isn't HTTPS everywhere yet?

#115

Post by wodenokoto »

drdaeman wrote: post #62
wodenokoto wrote: post #59

When I lived in China I was pretty happy the https movement hadn't won yet. Sites that forced me on a secure line were basically useless. The great firewall doesn't appreciate encrypted connections, and will usually grind to a halt, when deciding if it will let you get the content.

Isn't it the contrary. If Internet would be practically unavailable in China except for domestic resources, due to every single server using TLS for absolutely anything — would Great Firewall survive?

Yes, it would and is. Remember that all major webservices that take up most of peoples online time in the US and Europe is already banned in China. There is no Netflix, Hulu, Facebook, Google, Youtube, twitter, snapchat, Whatsapp working at all or reliably within the firewall.

The quality of the content inside the firewall is good enough for the majority of the population not to care the least about what is happening on the web outside the firewall.

The good viral videos and memes get translated and spread on local services, and plenty are already created within.

Re: Why isn't HTTPS everywhere yet?

#116

Post by manigandham »

pmlnr wrote: post #86
manigandham wrote: post #35

Earlier quoted context omitted.

Solution to what? Publishers still have to enable HTTPS on their sites and they'll only do that once all the resources on the page are HTTPS compatible.

To this: http://idlewords.com/talks/website_obesity.htm

While I agree with the gist of that article/presentation, it's more on the silly side compared to many other more detailed and accurate pieces about the growing weight of the modern web.

While blocking ads will help some (and certainly some ad providers have gone way too far with their bandwidth/cpu requirements), the web is just a richer media experience than before. The mainstream does not just want text and 80-90% of the page weight ends up being images, even on that article itself. There are other advancements like HTTP/2 and modern CDNs and better image formats like FLIF that will solve this problem much more effectively without going back to a textual world.

Still don't see what any of this has to do with HTTPS encryption everywhere though...

Re: Why isn't HTTPS everywhere yet?

#117

Post by manigandham »

angry-hacker wrote: post #93
manigandham wrote: post #28

Earlier quoted context omitted.

This is a big reason. Unfortunately the industry is full of old and/or poor tech that is already fragile as it is. All modern ad networks (like ours) are completely HTTPS ready but the transition will be slow due to momentum with existing vendors.

Well, even Amazon (affiliate) ads server their image over http. So for whatever reason, even the owner of AWS can't serve their ads over https. Do you need to use their widgets in the first place is another question.

The reasons are as described - a big company with outdated or poor tech policies. Just because AWS is advanced doesn't mean every use of it is. Clearly Cloudfront supports HTTPS and has for a long time so they can enable it if they want to.

Re: Why isn't HTTPS everywhere yet?

#118

Post by manigandham »

GeneticGenesis wrote: post #2

Another big blocker is cost. For example, one of the biggest CDNs in the world (I'm looking at you, Akamai), charge dramatically more for delivering content over HTTPS. Let's say you're delivering video content at scale, the difference between HTTP and HTTPS delivery can be many millions of dollars a year. But why not use a different CDN, say Cloudfront which prices the same for HTTP and HTTPS?, well, simple, the sam…

Unless you're doing a lot of large files like media or downloads, I always recommend CloudFlare. It's a great service and there are no bandwidth or request costs.

Re: Why isn't HTTPS everywhere yet?

#119

Post by glasz »

zbuf wrote: post #99
dTal wrote: post #56

I'm not convinced it's even a great idea until something is done about a) the entirely broken CA trust model or b) mainstream web browser's entirely broken attitude to that trust model.

I am interested in (a). Recently I heard from a trusted source who works for a popular CDN that some top levels CAs, who are trusted in my browser, are known to be issuing certificates for domains which they have no authority to be doing so, for the purpose of man-in-the-middle analysis by certain parties. But that there is a reluctance to pull these certificates because that would be like switching off portions of t…

just listen to security now [0]. it'll make your blood boil how, e.g., symantec fucks up over and over again. this industry is full of incompetent idiots.

[0] https://twit.tv/shows/security-now (episode 532 is particularly revealing)

Re: Why isn't HTTPS everywhere yet?

#120

Post by nailer »

Loic wrote: post #84
cm2187 wrote: post #74

Cost is going to be taken care of by let's encrypt. I am surprised complexity of setting up SSL isn't mentioned in the article. First the tools are complex to use, use various formats for storing keys that are incompatible. In Linux you pretty much have to rely on cryptic command lines. Windows is slightly simpler. And you need more tools to convert certificates between the different formats (for instance using an II…

The cipher list is effectively a big issue. When using the good old Sun Fortran compiler, I was used to have a -fast flag which would be smart to detect the hardware and be as fast as possible while respecting the IEEE maths (as far as I can remember). I would love a -secure flag to just use the most secure option of the current version of the software even at the cost of X years of backward compatibility at the tool…

> I would love a -secure flag to just use the most secure option of the current version of the software even at the cost of X years of backward compatibility at the tool/client/browser level.

> ssl_ciphers SECURE;

That's actually pretty close to nginx's default (unpatched) config (http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_c...), except openssl calls it HIGH.

ssl_ciphers HIGH:!aNULL:!MD5;

How high HIGH is depends on your version of openssl, ie, you probably don't want it for, say RHEL 5's openssl. Which (openssl has a long lifecycle, LTS Linux distros extend it further) some places may still be using.

https://www.openssl.org/docs/manmaster/apps/ciphers.html

A better implementation of the same concept is Mozilla's SSL Config Generator (which is what CertSimple point customers to - we also maintain the node port): it has Modern/Intermediate/Old with a clear idea of the compatibility you're losing with each: https://mozilla.github.io/server-side-tls/ssl-config-generat...

Post reply on HN