See also: https://https.cio.gov/
I suspect they haven't caught up with the mandate.
US Senate website says use HTTP instead of HTTPS
81–90 of 129 posts
Re: US Senate website says use HTTP instead of HTTPS
#82See also: https://https.cio.gov/ I suspect they haven't caught up with the mandate.
As a White House memorandum, that mandate only applies to the executive branch.
Though the GSA's HTTPS adoption dashboard does include legislative branch domains, including senate.gov:
Re: US Senate website says use HTTP instead of HTTPS
#83Excuse the ignorance, but what's the problem if it's purely an informational read only site? There's no logins, prompts, messaging that can be exploited. What's the problem of it being unencrypted? Don't get me wrong I'm all for https when there's user information to be protected back and forth, I just don't see the applicability for it here.
Here's some rationale on why it's worth using HTTPS for everything, even the less sensitive things:
https://https.cio.gov/everything/
A lot of people focus on targeted surveillance of people visiting individual sites, but there are so many other threats and issues out there. Bulk modification of unencrypted traffic is a particularly nasty one, and has been seen in the wild, at scale, multiple times.
Re: US Senate website says use HTTP instead of HTTPS
#84Excuse the ignorance, but what's the problem if it's purely an informational read only site? There's no logins, prompts, messaging that can be exploited. What's the problem of it being unencrypted? Don't get me wrong I'm all for https when there's user information to be protected back and forth, I just don't see the applicability for it here.
If you visit any non-https site, then you leave a vector wide open for a MITM to perform numerous types of attacks. Not just against the unencrypted site you're visiting. They can launch phishing attacks or CSRF attacks or inject malware. If every site were https, then that would provide a huge boost to peoples privacy and security.
>If you visit any non-https site, then you leave a vector wide open for a MITM to perform numerous types of attacks.
how?
Re: US Senate website says use HTTP instead of HTTPS
#85Earlier quoted context omitted.
Well, briefly - the General Service Administration declared "By September 30, 2014, agencies needed to update their public networks to Internet Protocol Version 6 (IPv6)" There is an exception process, but Akamai already supports IPv6 (though they do charge extra for it, booo!). You'd like to think something as high visibility (PR, not web traffic) as senate.gov would comply with the GSA. http://gsablogs.gsa.gov/tech…
The US Senate is not an agency. They are a branch of Congress, and therefore definitely not required to do anything a executive agency tells them to do -- especially if it's reasonable like implementing HTTPS.
Yes, the IPv6 is a White House (not GSA) mandate, like https://https.cio.gov. It doesn't apply to the legislative or judicial branches, and in that blog post, GSA is advertising the services it can offer other agencies to help them achieve IPv6 compliance.
Re: US Senate website says use HTTP instead of HTTPS
#86Perhaps they don't have the resources to serve all requests over https at this time?
Re: US Senate website says use HTTP instead of HTTPS
#87Excuse the ignorance, but what's the problem if it's purely an informational read only site? There's no logins, prompts, messaging that can be exploited. What's the problem of it being unencrypted? Don't get me wrong I'm all for https when there's user information to be protected back and forth, I just don't see the applicability for it here.
Several people have already mentioned the risks of MITM on a .gov domain. In this case, I think it goes beyond the usual risk of injecting malware / etc. on a trustworthy domain because it'd make an interesting watering hole attack because some of the visitors to senate.gov are going to be people with interesting information or access both on their computers and via their social networks.
Imagine if, say, a foreign intelligence agency managed to compromise some routers, do some DNS poisoning, etc. in the DC area and, being professionals, instead of injecting adware they inject a quiet zero-day which scrapes network info, contacts, etc. and reports home. Some of that will be political junkies, kids working on school reports, etc. but I'm sure you'd also get access to clients at a bunch of interesting agencies, NGOs, etc. which would be helpful for more targeted attacks.
Re: US Senate website says use HTTP instead of HTTPS
#88Excuse the ignorance, but what's the problem if it's purely an informational read only site? There's no logins, prompts, messaging that can be exploited. What's the problem of it being unencrypted? Don't get me wrong I'm all for https when there's user information to be protected back and forth, I just don't see the applicability for it here.
Here's some rationale on why it's worth using HTTPS for everything, even the less sensitive things: https://https.cio.gov/everything/ A lot of people focus on targeted surveillance of people visiting individual sites, but there are so many other threats and issues out there. Bulk modification of unencrypted traffic is a particularly nasty one, and has been seen in the wild, at scale, multiple times.
A US .gov page recommending the use of HTTPS everywhere, in a thread complaining that another US .gov site recommends using HTTP over HTTPS. I find this hilariously ironic!
Re: US Senate website says use HTTP instead of HTTPS
#89Excuse the ignorance, but what's the problem if it's purely an informational read only site? There's no logins, prompts, messaging that can be exploited. What's the problem of it being unencrypted? Don't get me wrong I'm all for https when there's user information to be protected back and forth, I just don't see the applicability for it here.
I saw an answer to this type of question like: why bother requesting something (even plaintext) over the wire if you can't vouch that it's the content you wanted, from the person you expected.