Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US Senate website says use HTTP instead of HTTPS

senate.gov

Post reply on HN
Print view View original

71–80 of 129 posts

Re: US Senate website says use HTTP instead of HTTPS

#71

Post by blowski »

throwaway16385 wrote: post #49
mike-cardwell wrote: post #19

Earlier quoted context omitted.

The trade-off is worth it. By a large margin.

YMMV. In my consistent experience over 5+ years, https always performs worse on poor-quality mobile connections here in the UK. In rural areas with EDGE or poor 3G, a given site will simply not load over https but it will (slowly) over http. So the trade-off for me is between "senate.gov doesn't load, at all" and "senate.gov does load, but may leak the information to someone that I was looking at senate.gov, or may p…

In this case, the site is enforcing HTTP - you can't view it on HTTPS.

Re: US Senate website says use HTTP instead of HTTPS

#72

Post by kelnos »

demarq wrote: post #15

I also noticed it seems blocked from access outside the US... so what would happen if a traveling american wants to access it? edit: FYI I'm trying from Kenya. edit2: Using my phone I'm able to switch between wifi, and mobile and on mobile it is unblocked. hmmm Also for those who don't see the Access Denied page but are curious, here is what it reads in full. -------------------- Access Denied You don't have permissi…

That looks like an Akamai error message (yup, www.senate.gov is a CNAME for e483.g.akamaiedge.net). Akamai has a bunch of (frankly ridiculous) heuristics for developing IP blacklists. So likely whatever network you're on got blacklisted for some inscrutable reason.

Re: US Senate website says use HTTP instead of HTTPS

#73

Post by dest »

demarq wrote: post #15

I also noticed it seems blocked from access outside the US... so what would happen if a traveling american wants to access it? edit: FYI I'm trying from Kenya. edit2: Using my phone I'm able to switch between wifi, and mobile and on mobile it is unblocked. hmmm Also for those who don't see the Access Denied page but are curious, here is what it reads in full. -------------------- Access Denied You don't have permissi…

Same message here (France). Are you a Tor node by any chance?

Re: US Senate website says use HTTP instead of HTTPS

#74

Post by Hondor »

raimille1 wrote: post #24

Excuse the ignorance, but what's the problem if it's purely an informational read only site? There's no logins, prompts, messaging that can be exploited. What's the problem of it being unencrypted? Don't get me wrong I'm all for https when there's user information to be protected back and forth, I just don't see the applicability for it here.

Since it's a .gov domain, people can assume that everything on it is published by the US government. Nobody else can register a .gov domain. So a MITM injecting ads or changing the content would be worse than for a .com site.

Re: US Senate website says use HTTP instead of HTTPS

#75

Post by mborch »

blackhaz wrote: post #59
blowski wrote: post #50

Earlier quoted context omitted.

Optimise for the most common case. I imagine there are far more people in the US with broadband connections being put at risk of MITM attacks than people in Kenya with very slow internet trying to look at the US governments website.

I am not against HTTPS per se. Use it for sensitive content.

If you live in a country where you can't trust your ISP then there is a very real MITM risk.

Re: US Senate website says use HTTP instead of HTTPS

#76

Post by Puts »

ketralnis wrote: post #32
raimille1 wrote: post #24

Excuse the ignorance, but what's the problem if it's purely an informational read only site? There's no logins, prompts, messaging that can be exploited. What's the problem of it being unencrypted? Don't get me wrong I'm all for https when there's user information to be protected back and forth, I just don't see the applicability for it here.

Theoretical, but: 1. MITM to return fraudulent data ("click here to input your personal data to collect your government cheque from this new federal grant!") 2. Recording browsing activity ("gee Mr. Smith, you sure do spend a lot of time looking up laws about X. Seems like a good thing to blackmail you about") Working those into actual problems is an exercise for the reader, but they're mostly what https is for There…

> Recording browsing activity

Yes, let's protect users visiting public available information from all the malicious eavesdroppers, while still posting all page requests to Google analytics...

Re: US Senate website says use HTTP instead of HTTPS

#77

Post by reustle »

ketralnis wrote: post #32
raimille1 wrote: post #24

Excuse the ignorance, but what's the problem if it's purely an informational read only site? There's no logins, prompts, messaging that can be exploited. What's the problem of it being unencrypted? Don't get me wrong I'm all for https when there's user information to be protected back and forth, I just don't see the applicability for it here.

Theoretical, but: 1. MITM to return fraudulent data ("click here to input your personal data to collect your government cheque from this new federal grant!") 2. Recording browsing activity ("gee Mr. Smith, you sure do spend a lot of time looking up laws about X. Seems like a good thing to blackmail you about") Working those into actual problems is an exercise for the reader, but they're mostly what https is for There…

> Recording browsing activity ("gee Mr. Smith, you sure do spend a lot of time looking up laws about X. Seems like a good thing to blackmail you about")

Are the URLs in an HTTPS request also encrypted? I was under the impression they weren't.

Re: US Senate website says use HTTP instead of HTTPS

#78

Post by theandrewbailey »

reustle wrote: post #77
ketralnis wrote: post #32

Earlier quoted context omitted.

Theoretical, but: 1. MITM to return fraudulent data ("click here to input your personal data to collect your government cheque from this new federal grant!") 2. Recording browsing activity ("gee Mr. Smith, you sure do spend a lot of time looking up laws about X. Seems like a good thing to blackmail you about") Working those into actual problems is an exercise for the reader, but they're mostly what https is for There…

> Recording browsing activity ("gee Mr. Smith, you sure do spend a lot of time looking up laws about X. Seems like a good thing to blackmail you about") Are the URLs in an HTTPS request also encrypted? I was under the impression they weren't.

They are. The only thing that could be gathered from an HTTPS connection is the IP, and therefore, possibly the domain.

Re: US Senate website says use HTTP instead of HTTPS

#79

Post by billyhoffman »

theandrewbailey wrote: post #78
reustle wrote: post #77

Earlier quoted context omitted.

> Recording browsing activity ("gee Mr. Smith, you sure do spend a lot of time looking up laws about X. Seems like a good thing to blackmail you about") Are the URLs in an HTTPS request also encrypted? I was under the impression they weren't.

They are. The only thing that could be gathered from an HTTPS connection is the IP, and therefore, possibly the domain.

For all browsers made in the last 10 years, SNI is sent as part of the SSL/TLS handshake, so the hostname of the site you are trying to connect to is included in the ClientHello and is visible to anyone that can monitor the network.

Re: US Senate website says use HTTP instead of HTTPS

#80

Post by mikecb »

billyhoffman wrote: post #79
theandrewbailey wrote: post #78

Earlier quoted context omitted.

They are. The only thing that could be gathered from an HTTPS connection is the IP, and therefore, possibly the domain.

For all browsers made in the last 10 years, SNI is sent as part of the SSL/TLS handshake, so the hostname of the site you are trying to connect to is included in the ClientHello and is visible to anyone that can monitor the network.

Hostname, but not path.
Post reply on HN