US Senate website says use HTTP instead of HTTPS • Hacker News Board

Re: US Senate website says use HTTP instead of HTTPS

#111

Post by tdkl » Fri, May 06, 2016, 4:54 PM UTC

majewsky wrote: post #60

tdkl wrote: post #58

Earlier quoted context omitted.

Commercial mass mail for informing isn't sent in envelopes. I presume that's what the parent was talking about.

It isn't? At least in Germany, commerical mass mail is always sent out in envelopes. I guess that, in this particular case, the reason for the envelopes is to conceal the ads inside them until the recipient has taken the time to open the envelope.

Well this ain't the norm here (a little bit south from you, still EU). Perhaps it has to do with Germany being always more vary of privacy for history reasons, but is merely a EU recommendation, not enforced by law.

Not targeted for your reply, just clarifying the previous post: I don't appreciate the down votes though, I wasn't stating that OP opinion is right, it was just my understanding of what he meant and trying to understand it.

Re: US Senate website says use HTTP instead of HTTPS

#112

Post by tdkl » Fri, May 06, 2016, 4:55 PM UTC

georgemcbay wrote: post #68

majewsky wrote: post #60

Earlier quoted context omitted.

It isn't? At least in Germany, commerical mass mail is always sent out in envelopes. I guess that, in this particular case, the reason for the envelopes is to conceal the ads inside them until the recipient has taken the time to open the envelope.

In the USA, most commercial mass advertising mail is in large printed flyer form, not enclosed in any kind of external envelope. Kinda like this: http://thumbs.dreamstime.com/z/sale-advertising-papers-15592... The advertisers pay bulk rates to USPS to stuff all this crap directly in our mailboxes. There are some exceptions which arrive in envelopes, mostly to trick you into thinking it isn't just spam mail like the r…

Yep, same here. We do have an option to place a special sticker on the mailbox, which indicates to the postal worker that he doesn't put that kind of bulk commercial material inside.

Re: US Senate website says use HTTP instead of HTTPS

#113

Post by brians » Fri, May 06, 2016, 5:18 PM UTC

theandrewbailey wrote: post #78

reustle wrote: post #77

Earlier quoted context omitted.

> Recording browsing activity ("gee Mr. Smith, you sure do spend a lot of time looking up laws about X. Seems like a good thing to blackmail you about") Are the URLs in an HTTPS request also encrypted? I was under the impression they weren't.

They are. The only thing that could be gathered from an HTTPS connection is the IP, and therefore, possibly the domain.

This is a common and dangerous mistake. The size and timing of requests is visible, as is the hostname. It is straightforward to watch a cafe and identify all the requests corresponding to Wikipedia, and within those the Tienenman Square page.

HTTPS is designed to protect secrets, not privacy. That means short random bitstrings, given that the adversary knows you're passing short random bitstrings---TLS just keeps him from figuring out the actual random content.

Re: US Senate website says use HTTP instead of HTTPS

#114

Post by willnorris » Fri, May 06, 2016, 7:11 PM UTC

konklone wrote: post #82

zeckalpha wrote: post #81

See also: https://https.cio.gov/ I suspect they haven't caught up with the mandate.

As a White House memorandum, that mandate only applies to the executive branch. Though the GSA's HTTPS adoption dashboard does include legislative branch domains, including senate.gov: https://pulse.cio.gov/https/domains/#q=legislative

Somewhat confusingly, pulse.cio.gov lists senate.gov as supporting HTTPS with an 'A' from SSL Labs. While that is of course technically correct, it doesn't tell the full story, since no actual content is served over HTTPS.

Would it be worth trying to update pulse.cio.gov to detect cases like this? That's non-trivial to do in a reliable automated fashion, but seems like it might be worth the effort?

Re: US Senate website says use HTTP instead of HTTPS

#115

Post by jamesdwilson » Fri, May 06, 2016, 7:47 PM UTC

Buge wrote: post #101

raimille1 wrote: post #24

Excuse the ignorance, but what's the problem if it's purely an informational read only site? There's no logins, prompts, messaging that can be exploited. What's the problem of it being unencrypted? Don't get me wrong I'm all for https when there's user information to be protected back and forth, I just don't see the applicability for it here.

When sites don't use https, China MITMs the page, and inserts malicious javascript that enters the user's browser into a botnet that launches a DDOS attack on the github pages of human rights organizations, causing github downtime. If you don't want your website viewers to be entered into a botnet, then use https. https://citizenlab.org/2015/04/chinas-great-cannon/

as does US GOV... https://www.wired.com/2015/04/researchers-uncover-method-det...

Re: US Senate website says use HTTP instead of HTTPS

#116

Post by justacommentx » Fri, May 06, 2016, 8:41 PM UTC

cbd1984 wrote: post #55

raimille1 wrote: post #24

Excuse the ignorance, but what's the problem if it's purely an informational read only site? There's no logins, prompts, messaging that can be exploited. What's the problem of it being unencrypted? Don't get me wrong I'm all for https when there's user information to be protected back and forth, I just don't see the applicability for it here.

Why is most of your mail sent in envelopes as opposed to on postcards? Why don't people default to postcards, and only use envelopes when they have something to hide? This isn't about traffic analysis, it's about social expectations and social norms. If privacy is the default, the social norm is to be private, and to expect privacy. That's important.

True, and this has a legal implication too. If privacy while browsing the Web isn't expected, then law enforcement doesn't need a warrant to ask for this data. So let's maintain our expectation of privacy.

Re: US Senate website says use HTTP instead of HTTPS

#117

Post by ryan_lane » Fri, May 06, 2016, 11:57 PM UTC

excalibur wrote: post #97

technion wrote: post #70

Earlier quoted context omitted.

- Nearly every "informational only" website will end up with feature creep moving it out of that - Simply not having SSL setup is one thing. But the linked page has, not only a valid SSL certificate, but someone went through the awful process of acquiring an EV certificate. To go through that, and then choose to not use it, boggles the mind

EV isn't that difficult to acquire, only more expensive. Not a huge deal when working with other people's money. What boggles the mind is that the US Senate is using a commercial CA for their website.

Would you be OK with your browser trusting a US government managed CA in its default trust list?

Re: US Senate website says use HTTP instead of HTTPS

#118

Post by earleybird » Sat, May 07, 2016, 2:23 AM UTC

Puts wrote: post #76

ketralnis wrote: post #32

Earlier quoted context omitted.

Theoretical, but: 1. MITM to return fraudulent data ("click here to input your personal data to collect your government cheque from this new federal grant!") 2. Recording browsing activity ("gee Mr. Smith, you sure do spend a lot of time looking up laws about X. Seems like a good thing to blackmail you about") Working those into actual problems is an exercise for the reader, but they're mostly what https is for There…

> Recording browsing activity Yes, let's protect users visiting public available information from all the malicious eavesdroppers, while still posting all page requests to Google analytics...

piwik

Re: US Senate website says use HTTP instead of HTTPS

#119

Post by Buge » Sat, May 07, 2016, 2:43 AM UTC

jamesdwilson wrote: post #115

Buge wrote: post #101

Earlier quoted context omitted.

When sites don't use https, China MITMs the page, and inserts malicious javascript that enters the user's browser into a botnet that launches a DDOS attack on the github pages of human rights organizations, causing github downtime. If you don't want your website viewers to be entered into a botnet, then use https. https://citizenlab.org/2015/04/chinas-great-cannon/

as does US GOV... https://www.wired.com/2015/04/researchers-uncover-method-det...

Good point. Although some people might say that that isn't something they need to protect their website users against, because Quantum Insert is targeted only against very specific users such as terrorists. The Great Cannon targets all internet users indiscriminately, so website owners are more likely to sympathize with them and want to protect them.

Re: US Senate website says use HTTP instead of HTTPS

#120

Post by konklone » Sat, May 07, 2016, 2:20 PM UTC

willnorris wrote: post #114

konklone wrote: post #82

Earlier quoted context omitted.

As a White House memorandum, that mandate only applies to the executive branch. Though the GSA's HTTPS adoption dashboard does include legislative branch domains, including senate.gov: https://pulse.cio.gov/https/domains/#q=legislative

Somewhat confusingly, pulse.cio.gov lists senate.gov as supporting HTTPS with an 'A' from SSL Labs. While that is of course technically correct, it doesn't tell the full story, since no actual content is served over HTTPS. Would it be worth trying to update pulse.cio.gov to detect cases like this? That's non-trivial to do in a reliable automated fashion, but seems like it might be worth the effort?

Yeah, I'm torn on it. It's clearly not the right information. But one of the benefits of an automated approach is that everyone's being treated equally, and people can't complain about unfair treatment.

In the case of the Senate, their current configuration prevents them from using HSTS or enforcing HTTPS, so the other columns will still show as lacking.