Why on Earth could they possibly feel it necessary to do this? The United States Patent Office doesn't have a complex system of sub-domains or even an EV license, if money were the object then they could just go with Let's Encrypt (not to mention the current license continues until 2018 anyway). The amount of computing power it takes to encrypt with SSL is minimal, especially if you use some of the newer systems like…
“Users will only be able to view patents via HTTP. HTTPS will no longer work”
11–20 of 172 posts
Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”
#12Is this a joke?
* except uspto.gov
Are there any other .gov sites doing this? Can anyone shed more light on this?
Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”
#13Why on Earth could they possibly feel it necessary to do this? The United States Patent Office doesn't have a complex system of sub-domains or even an EV license, if money were the object then they could just go with Let's Encrypt (not to mention the current license continues until 2018 anyway). The amount of computing power it takes to encrypt with SSL is minimal, especially if you use some of the newer systems like…
Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”
#14They have a valid cert in use that only expires in 2019, and it's SHA256. But when you visit over HTTPS, this happens: HTTP/1.0 302 Found Location: http://portal.uspto.gov/pair/PublicPair Server: BigIP Why would they want to do this? Seems incredibly dumb to me, huge step backwards.
Does TLS termination cost extra for BigIP? Maybe their license expired or something?
Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”
#15And it's legal to publish a .GOV site using Drupal?
Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”
#16Why on Earth could they possibly feel it necessary to do this? The United States Patent Office doesn't have a complex system of sub-domains or even an EV license, if money were the object then they could just go with Let's Encrypt (not to mention the current license continues until 2018 anyway). The amount of computing power it takes to encrypt with SSL is minimal, especially if you use some of the newer systems like…
Well if you put on your tinfoil hat - maybe someone wants to track who's viewing which patents, which they can't do when it's encrypted. You're right, it doesn't make any sense to do this, so there must be an ulterior motive.
They'd have that data already, so could just share it directly.
Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”
#17Earlier quoted context omitted.
Does TLS termination cost extra for BigIP? Maybe their license expired or something?
TLS offload is usually extra on F5 BigIP
Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”
#18Has this been superseded by a new policy?
Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”
#19Also, at the bottom of the page "This page is owned by Service Desk." What does that mean? And it's legal to publish a .GOV site using Drupal?
It indicates what department of the USPTO manages that page of the website. All pages have a "page-owner" tag in the footer.
Re: “Users will only be able to view patents via HTTP. HTTPS will no longer work”
#20Why on Earth could they possibly feel it necessary to do this? The United States Patent Office doesn't have a complex system of sub-domains or even an EV license, if money were the object then they could just go with Let's Encrypt (not to mention the current license continues until 2018 anyway). The amount of computing power it takes to encrypt with SSL is minimal, especially if you use some of the newer systems like…
It's also possible that their configuration was causing them performance problems and decreasing overhead by killing HTTPS for "unnecessary" endpoints was seen as a potential solution. Requesting a public record about a patent is not something that, at first glance, seems like it should need to be transferred over a secure protocol.
Of course, none of these are really good reasons to disable HTTPS, but they're some potential explanations.
-----
Separately, I think some people who remember HTTPS being used to secure "true secret" pages kind of resent the "HTTPS must be used anywhere and everywhere" trend that has taken hold. It's not that there aren't good reasons to do that, but it's also silly to pretend there aren't side effects of doing it.
From some perspectives, the need to encrypt all communication can be seen as an external concern for something like a VPN tunnel to handle. End-to-end crypto is good because it, theoretically, precludes reception from anyone who can get in the middle of the server and the VPN, but it needs to be more transparent before everyone is willing to consider that a worthwhile/important tradeoff.
One side effect of HTTPS everywhere is that the site can no longer really designate some portion of traffic as "secret". If every admin in your org needs to be able to decrypt all HTTPS traffic to debug issues, you're giving some access away. Maybe some of them would've been able to get to that data anyway, but probably many of them would not.
Again, this is not to say that that HTTPS shouldn't be used, but just some musings into why someone would not necessarily be enthusiastic about it. Working to integrate HTTPS more transparently to admins and working toward the ability to mark specific information for extra "app-layer secrecy" instead of just relying on transport-layer secrecy seem like they'd be good steps.