Live data from Hacker News

US Senate website says use HTTP instead of HTTPS

senate.gov

91–100 of 129 posts

Re: US Senate website says use HTTP instead of HTTPS

#91

Earlier quoted context omitted.

If you visit any non-https site, then you leave a vector wide open for a MITM to perform numerous types of attacks. Not just against the unencrypted site you're visiting. They can launch phishing attacks or CSRF attacks or inject malware. If every site were https, then that would provide a huge boost to peoples privacy and security.

>If you visit any non-https site, then you leave a vector wide open for a MITM to perform numerous types of attacks. how?

I gave 3 examples. Phishing, malware injection and CSRF. If you want to know how these sorts of attacks work, there isn't enough space in a HN comment so go use a search engine.

Re: US Senate website says use HTTP instead of HTTPS

#92

Earlier quoted context omitted.

If you visit any non-https site, then you leave a vector wide open for a MITM to perform numerous types of attacks. Not just against the unencrypted site you're visiting. They can launch phishing attacks or CSRF attacks or inject malware. If every site were https, then that would provide a huge boost to peoples privacy and security.

>If you visit any non-https site, then you leave a vector wide open for a MITM to perform numerous types of attacks. how?

it's fairly common for an ISP to inject popups into web traffic (or redirect your dns)

Re: US Senate website says use HTTP instead of HTTPS

#93
post #31

Excuse the ignorance, but what's the problem if it's purely an informational read only site? There's no logins, prompts, messaging that can be exploited. What's the problem of it being unencrypted? Don't get me wrong I'm all for https when there's user information to be protected back and forth, I just don't see the applicability for it here.

You could do a MITM attack and change a Senator's email address to spy@russia.com. Ok it's a long shot, but not being able to serve your site over https is also a flag that your technical configuration has problems.

Not even that they're unable, there's a valid certificate & they're deliberately not using it for the site.

Re: US Senate website says use HTTP instead of HTTPS

#94
post #22

Earlier quoted context omitted.

I can see the http version in Japan.

I am in Tokyo and both versions are blocked for me.

I'm in Nagoya. Maybe that is the reason? It's so odd——I just confirmed that this works for me: http://www.senate.gov/index.htm

Re: US Senate website says use HTTP instead of HTTPS

#95

Can someone tell me why this might have been required? What are the situations which might prompt a developer to make their users use http instead of https?

Think of the government as a particular large, stratified enterprise IT shop with some weighty policy/legal requirements driving some of the internal barriers. I'm imagining that it went something like this: the group which owns the public web servers decides to start using HTTPS and slogs through renegotiating their CDN contract, purchasing and installing an EV certificate, etc.

As they go through compatibility testing, someone finds a problem. Maybe that's a bunch of legacy HTML which triggers mixed-content warnings, maybe that's a problem with some creaky old legacy application which expects HTTP and doesn't follow redirects or chokes on modern cipher suites, etc.

Since they can no longer say that switching won't break anything, someone pauses the project until they can fix the problems. Maybe someone suggests using a rewriting proxy to fix it but the people who own the server it'd need to run on are worried about performance/security. Maybe the legacy app is something licensed from a vendor who wants $$$ for a major upgrade rather than just making this one change. Maybe that requires a change in next year's budget because they've already allocated all of the money they're legally allowed to spend on that class of work.

It could be as simple as budget: they're using Akamai and it's likely that the contract they originally signed didn't include HTTPS, and at least in the past adding it was a non-trivial price increase. I could easily believe that this could be as simple as either a test pending a new contract or that a section of the website (or a subdomain) uses HTTPS but they added a general redirect to avoid paying the higher HTTPS rates for traffic which doesn't require it.

Re: US Senate website says use HTTP instead of HTTPS

#96

I'd forgotten how fast everything loads if you use http instead of https. It's quite refreshing to not have that initial half-second or so lag that you get when loading an https page. Hopefully we'll make back some of the difference once http/2 is more widespread.

Well, for me that's only true for the first time I visit a website.

HN, for example, loads in less than half a second, due to using a CDN (i.e. Cloudflare).

With CDNs, the RTTs are small enough to not matter.

Re: US Senate website says use HTTP instead of HTTPS

#97

Excuse the ignorance, but what's the problem if it's purely an informational read only site? There's no logins, prompts, messaging that can be exploited. What's the problem of it being unencrypted? Don't get me wrong I'm all for https when there's user information to be protected back and forth, I just don't see the applicability for it here.

- Nearly every "informational only" website will end up with feature creep moving it out of that - Simply not having SSL setup is one thing. But the linked page has, not only a valid SSL certificate, but someone went through the awful process of acquiring an EV certificate. To go through that, and then choose to not use it, boggles the mind

EV isn't that difficult to acquire, only more expensive. Not a huge deal when working with other people's money. What boggles the mind is that the US Senate is using a commercial CA for their website.

Re: US Senate website says use HTTP instead of HTTPS

#98

Earlier quoted context omitted.

>If you visit any non-https site, then you leave a vector wide open for a MITM to perform numerous types of attacks. how?

it's fairly common for an ISP to inject popups into web traffic (or redirect your dns)

by the way, is it legal? how do they explain that?

Re: US Senate website says use HTTP instead of HTTPS

#99

Earlier quoted context omitted.

You mean that super costly 1KB in front of a request that pulls extra megabyte of data on a typical website? I really hope you missed a /s

I can save about 30% of traffic by optimizing content via HTTP. Can't do that with HTTPS without MITM or similar questionable practices breaking the purpose of HTTPS. While you're sitting on a 100+ Mbps DSL, somebody in the middle of Africa is struggling on an ISDN-like link.

What exactly are these techniques that work in plain HTTP but not in HTTPS? It seems like the difference between the two does not pertain to the actual content at all, but I am more curious than knowledgeable in this case.
Post reply on HN