Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Automatic HTTPS Enforcement for New Executive Branch .gov Domains

cio.gov

Post reply on HN
Print view View original

71–80 of 82 posts

Re: Automatic HTTPS Enforcement for New Executive Branch .gov Domains

#71

Post by konklone »

hrjet wrote: post #70
konklone wrote: post #50

Earlier quoted context omitted.

I wouldn't say this is reinventing the CA system. You don't need to trust any particular browser here. The effect is that web services must offer a secure HTTPS connection, using the existing CA system (or an enterprise CA, if their user base is truly all-enterprise), no matter what browser is being used.

> You don't need to trust any particular browser here. You do need to trust that the particular browser you are using supports preloaded list, and is using the latest updated version of the list, and is not missing any entries!

What you're trusting the browser for there is the extra protection that preloading provides, but that's not the whole benefit here. The larger benefit is that it makes it infeasible for services to neglect to support HTTPS. So, even if your browser's preload list is busted, the site will be guaranteed to support HTTPS because of this effort, which you'll still benefit from.

Re: Automatic HTTPS Enforcement for New Executive Branch .gov Domains

#72

Post by stqism »

austincheney wrote: post #13
konklone wrote: post #2

Co-author of the post here, happy to answer questions. =) This is a GSA initiative, not an 18F initiative. But 18F has a recent post detailing executive branch progress on HTTPS that may also be relevant: https://18f.gsa.gov/2017/01/04/tracking-the-us-governments-p...

Does this include DOD? I suspect DOD is probably already doing this, but just wonder if they fall under the umbrella.

The DoD has a massive PKI system already and makes the assumption users of its sites have the appropriate CAs installed. (Home access typically requires installing a set of them, typically bundled separately or in an installer)

Re: Automatic HTTPS Enforcement for New Executive Branch .gov Domains

#73

Post by Bartweiss »

walrus01 wrote: post #63
Bartweiss wrote: post #5

This is fantastic news. It wasn't that long ago that I tried to log into a government site via my SSN, and discovered that the page didn't even permit HTTPS. I was displeased, to say the least; logging in wasn't exactly optional, so it seemed much worse than a business offering poor security. Permitting HTTPS is obviously the first step, but security shouldn't be limited to people with the expertise to seek it out. I…

Please name and shame the httpd that's asking for plaintext SSNs... That's newsworthy and I'm sure some tech journalists will pick it up on a slow day.

It was a state jobs site which has since updated to HTTPS. They still suck in a lot of ways - the required login is SSN, plus an 8-digit (numeric only) PIN. That's a laughably bad login scheme, but at least they aren't passing it in the clear.

If I do see it again, is there anything like a clearinghouse for this sort of complaint?

Re: Automatic HTTPS Enforcement for New Executive Branch .gov Domains

#74

Post by EdHominem »

brainfire wrote: post #67
EdHominem wrote: post #65

Earlier quoted context omitted.

> It would have to be one of the four people with root. Or anyone who'd ever gotten access to the computer, or installed a camera near it, etc. The critical part of that answer though, is "one of the". The system fails if any of the individuals is be malicious. A more-robust system would require multiple malicious agents in various organizational silos (security, compliance, management) to fail. > every time the priv…

> A more-robust system would require multiple malicious agents in various organizational silos (security, compliance, management) to fail. Yes, and at that point the name for it is "policy". These are our own keys after all- nobody would blink an eye if they were supposed to be collected. They're not.

> They're not. [keys not collected by another agency]

Right. I think you're absolutely correct, now. And I fully expect (hope!) that the NSA will one-day come to you with some more-secure hardware and that you will gladly cooperate because as you say - we are all on the same team.

My point is that you can't say what you're saying now. You aren't secure, and you don't have the type of procedures that would ever let you get to more than a 4/10 or so. You don't even see having four independent points of failure as an issue, rather than a benefit.

By promising people that the NSA does not have your organization's keys you're providing the less technical with a false picture.

And maybe, one day, that might matter. You might trick the next leaker into trusting your org as a way to whistle-blow and cause them to be caught by the NSA before they reach the news.

> Yes, and at that point the name for it is "policy". [security procedures]

Yeah, and software is just automated policy. If this is a zero, and that's a zero, etc...

If the guard in the vault runs a non-exploitable policy (ie no "I'm the boss" backdoors) then you can greatly reduce evil-sysadmin attacks.

Re: Automatic HTTPS Enforcement for New Executive Branch .gov Domains

#75

Post by hrjet »

konklone wrote: post #71
hrjet wrote: post #70

Earlier quoted context omitted.

> You don't need to trust any particular browser here. You do need to trust that the particular browser you are using supports preloaded list, and is using the latest updated version of the list, and is not missing any entries!

What you're trusting the browser for there is the extra protection that preloading provides, but that's not the whole benefit here. The larger benefit is that it makes it infeasible for services to neglect to support HTTPS. So, even if your browser's preload list is busted, the site will be guaranteed to support HTTPS because of this effort, which you'll still benefit from.

Ah ok. I think I see what you are saying now. As long as a sizeable portion of browsers support a fresh version of the preloaded list, there is sufficient customer feedback to push the servers to only support https. Right?

Re: Automatic HTTPS Enforcement for New Executive Branch .gov Domains

#76

Post by brainfire »

EdHominem wrote: post #74
brainfire wrote: post #67

Earlier quoted context omitted.

> A more-robust system would require multiple malicious agents in various organizational silos (security, compliance, management) to fail. Yes, and at that point the name for it is "policy". These are our own keys after all- nobody would blink an eye if they were supposed to be collected. They're not.

> They're not. [keys not collected by another agency] Right. I think you're absolutely correct, now. And I fully expect (hope!) that the NSA will one-day come to you with some more-secure hardware and that you will gladly cooperate because as you say - we are all on the same team. My point is that you can't say what you're saying now. You aren't secure, and you don't have the type of procedures that would ever let yo…

Sorry, I'm not going to continue arguing with you. It's clear you don't understand the scope of what you're proposing is happening.

Re: Automatic HTTPS Enforcement for New Executive Branch .gov Domains

#77

Post by willstrafach »

brainfire wrote: post #76
EdHominem wrote: post #74

Earlier quoted context omitted.

> They're not. [keys not collected by another agency] Right. I think you're absolutely correct, now. And I fully expect (hope!) that the NSA will one-day come to you with some more-secure hardware and that you will gladly cooperate because as you say - we are all on the same team. My point is that you can't say what you're saying now. You aren't secure, and you don't have the type of procedures that would ever let yo…

Sorry, I'm not going to continue arguing with you. It's clear you don't understand the scope of what you're proposing is happening.

Strangely, many tech folks seem to have normalized some very wild fantasies about what the NSA does.

Re: Automatic HTTPS Enforcement for New Executive Branch .gov Domains

#78

Post by EdHominem »

brainfire wrote: post #76
EdHominem wrote: post #74

Earlier quoted context omitted.

> They're not. [keys not collected by another agency] Right. I think you're absolutely correct, now. And I fully expect (hope!) that the NSA will one-day come to you with some more-secure hardware and that you will gladly cooperate because as you say - we are all on the same team. My point is that you can't say what you're saying now. You aren't secure, and you don't have the type of procedures that would ever let yo…

Sorry, I'm not going to continue arguing with you. It's clear you don't understand the scope of what you're proposing is happening.

I'm just saying you're making claims you cannot possibly verify. You say nobody is collecting your keys even though all you have is a lack of evidence either way. I also think you're probably, accidentally, right in this case. But only because I doubt you really have adversaries who care.

You're confusing being uninteresting with being safe. (Safety is numbers is irrelevant once you've been selected.)

> Sorry, I'm not going to continue arguing with you.

Stop clicking Reply.

Re: Automatic HTTPS Enforcement for New Executive Branch .gov Domains

#79

Post by belovedeagle »

profmonocle wrote: post #68
besselheim wrote: post #62

It should really be .gov.us rather than a top level domain.

.gov, .mil, and .edu predate the existence of country-code TLDs. They're a legacy of when the Internet was a US government funded research project. You could argue that since the Internet has become a global commercial network, the US should no longer have these special, exclusive TLDs. But switching over would be a ton of work, and there really aren't enough downsides to the US having these domains to justify a chan…

On the other hand, if we put in that effort now we won't have to listen to people who know nothing about how the internet came to be, and are indignant and shocked that the US government should have special treatment, for the next N decades. Seems almost worth it to me...

Re: Automatic HTTPS Enforcement for New Executive Branch .gov Domains

#80

Post by EdHominem »

willstrafach wrote: post #77
brainfire wrote: post #76

Earlier quoted context omitted.

Sorry, I'm not going to continue arguing with you. It's clear you don't understand the scope of what you're proposing is happening.

Strangely, many tech folks seem to have normalized some very wild fantasies about what the NSA does.

I'm using the NSA as an example of a foe of sufficient capability, not saying that this is what they do (to our own agencies at any rate.) Someone who can trojan hardware, suborn any given person, etc.

I was hoping to use a very advanced force as an example to show that things that may sound secure aren't if your attacker has a certain level of resources.

Fwiw, most pen-testers would aso be able to bypass any such casually enacted system too, but that's less obvious so I had hoped to avoid that argument by going with an extreme example.

Post reply on HN