Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US Senate website says use HTTP instead of HTTPS

senate.gov

Post reply on HN
Print view View original

41–50 of 129 posts

Re: US Senate website says use HTTP instead of HTTPS

#41

Post by unepipe »

SFJulie wrote: post #26
blowski wrote: post #8

Earlier quoted context omitted.

At a guess, it was built years ago by an agency selected on the basis of anything other than technical competence. As a result it probably has thousands of hard coded HTTP links and an oddly configured out of date web server. Given the 'encryption is only used by terrorists' climate, spending the time and money to make it work for https sounds like a hard sell. No sources, but I have done some work in UK public secto…

Well it does the job, and if it aint broken why fix it?

It creates an easy vector for MITM attacks - could be done by nefarious parties on US citizens traveling in other countries for example.

Re: US Senate website says use HTTP instead of HTTPS

#42

Post by logicallee »

How strange, I changed it to http as asked. For me it then asked for my social security number to login and then I needed to confirm some of my banking information for the IRS. I'd expect that to be information you'd want to protect!! I actually double checked to make sure I wasn't on a phising site but I was safe: "senate.gov" why did they need my banking information? Oh well.

The above is fiction, but an easy scenario under HTTP. Any AP (wifi access point, like at a cafe) can do it...

Re: US Senate website says use HTTP instead of HTTPS

#43

Post by alien3d »

demarq wrote: post #15

I also noticed it seems blocked from access outside the US... so what would happen if a traveling american wants to access it? edit: FYI I'm trying from Kenya. edit2: Using my phone I'm able to switch between wifi, and mobile and on mobile it is unblocked. hmmm Also for those who don't see the Access Denied page but are curious, here is what it reads in full. -------------------- Access Denied You don't have permissi…

nothing issue malaysia for http if https

The submitted https request was not able to be completed at this time. Please retry your request using http. This may require disabling some browser based plug-ins.

Re: US Senate website says use HTTP instead of HTTPS

#44

Post by sleepychu »

Ueland wrote: post #16
blackhaz wrote: post #13

And it's OK. This "HTTPS everywhere" concept is damaging. I think it should be revised. The amount of overhead and the lack of ability to optimize encrypted content for transferring over, say, satellite or other radio links, is bad. Lots of people still use very expensive (>$2,000 per Mbps) long-RTT connections that would benefit immensely from content optimization techniques. And most of them are cost-sensitive beca…

Something like gzip that "all" browsers and servers support? Which i would belive more than makes up for any https overhead.

They're proposing lossy compression. That'd be a neat feature though, during the negotiation (once your comms are encrypted) you could ask the server to perform lossy compression on certain resources, would save battery life on the mobile client as well!

Re: US Senate website says use HTTP instead of HTTPS

#45

Post by sleepychu »

beedogs wrote: post #23
blackhaz wrote: post #13

And it's OK. This "HTTPS everywhere" concept is damaging. I think it should be revised. The amount of overhead and the lack of ability to optimize encrypted content for transferring over, say, satellite or other radio links, is bad. Lots of people still use very expensive (>$2,000 per Mbps) long-RTT connections that would benefit immensely from content optimization techniques. And most of them are cost-sensitive beca…

This is almost as bad as when people were arguing against long signatures on Usenet. https is the least of your worries in terms of overhead.

> benefit immensely from content optimization techniques. And most of them are cost-sensitive because they live in developing countries You can't optimise the size of encrypted content until you've downloaded it. It could go through a third party on your behalf but then they argue, what's the point in the encryption at all.

Re: US Senate website says use HTTP instead of HTTPS

#46

Post by zyx321 »

aavotins wrote: post #20
demarq wrote: post #15

I also noticed it seems blocked from access outside the US... so what would happen if a traveling american wants to access it? edit: FYI I'm trying from Kenya. edit2: Using my phone I'm able to switch between wifi, and mobile and on mobile it is unblocked. hmmm Also for those who don't see the Access Denied page but are curious, here is what it reads in full. -------------------- Access Denied You don't have permissi…

Not blocked in the Netherlands, but it opens the https version , which displays the following error: The submitted https request was not able to be completed at this time. Please retry your request using http. This may require disabling some browser based plug-ins. Clicking the provided link causes a redirect loop(i.e. the http version redirects back to https)

>Clicking the provided link causes a redirect loop

Disabling HTTPS-Everywhere fixed that for me.

Re: US Senate website says use HTTP instead of HTTPS

#47

Post by sdiq »

demarq wrote: post #15

I also noticed it seems blocked from access outside the US... so what would happen if a traveling american wants to access it? edit: FYI I'm trying from Kenya. edit2: Using my phone I'm able to switch between wifi, and mobile and on mobile it is unblocked. hmmm Also for those who don't see the Access Denied page but are curious, here is what it reads in full. -------------------- Access Denied You don't have permissi…

Just tried from Kenya and did not see any "ACCESS DENIED".

This is what I am seeing: "Request unable to be completed. The submitted https request was not able to be completed at this time. Please retry your request using http. This may require disabling some browser based plug-ins."

Maybe something to do with your browser?

Edit: typo.

Re: US Senate website says use HTTP instead of HTTPS

#48

Post by blowski »

logicallee wrote: post #42

How strange, I changed it to http as asked. For me it then asked for my social security number to login and then I needed to confirm some of my banking information for the IRS. I'd expect that to be information you'd want to protect!! I actually double checked to make sure I wasn't on a phising site but I was safe: "senate.gov" why did they need my banking information? Oh well. The above is fiction, but an easy scena…

Also, oh the Senate is telling me I have to install this software to view the website. Well it is the US Senate, so I guess I'll click OK.

Re: US Senate website says use HTTP instead of HTTPS

#49

Post by throwaway16385 »

mike-cardwell wrote: post #19
blackhaz wrote: post #13

And it's OK. This "HTTPS everywhere" concept is damaging. I think it should be revised. The amount of overhead and the lack of ability to optimize encrypted content for transferring over, say, satellite or other radio links, is bad. Lots of people still use very expensive (>$2,000 per Mbps) long-RTT connections that would benefit immensely from content optimization techniques. And most of them are cost-sensitive beca…

The trade-off is worth it. By a large margin.

YMMV.

In my consistent experience over 5+ years, https always performs worse on poor-quality mobile connections here in the UK. In rural areas with EDGE or poor 3G, a given site will simply not load over https but it will (slowly) over http.

So the trade-off for me is between "senate.gov doesn't load, at all" and "senate.gov does load, but may leak the information to someone that I was looking at senate.gov, or may potentially be MITMed to give me misleading information about the US senate".

The balance of probabilities is such that the trade-off of enforced HTTPS everywhere, on sites like that, is _not_ worth it for me. I obviously don't object to people using HTTPS who want to. Nor do I object to sites where a MITM attack would be catastrophic (e.g. banks) requiring it. What I object to is that, where there's a balance-of-probabilities decision, I am increasingly no longer empowered to take that decision for myself, and the result is that I simply can't view many websites in particular circumstances.

Throwaway because being anything other than 100% supportive of HTTPS is the surest way to burn karma on HN.

Re: US Senate website says use HTTP instead of HTTPS

#50

Post by blowski »

blackhaz wrote: post #39
viraptor wrote: post #21

Earlier quoted context omitted.

You mean that super costly 1KB in front of a request that pulls extra megabyte of data on a typical website? I really hope you missed a /s

I can save about 30% of traffic by optimizing content via HTTP. Can't do that with HTTPS without MITM or similar questionable practices breaking the purpose of HTTPS. While you're sitting on a 100+ Mbps DSL, somebody in the middle of Africa is struggling on an ISDN-like link.

Optimise for the most common case. I imagine there are far more people in the US with broadband connections being put at risk of MITM attacks than people in Kenya with very slow internet trying to look at the US governments website.
Post reply on HN