Why Static Websites Need HTTPS • Hacker News Board

Re: Why Static Websites Need HTTPS

#131

Post by pixl97 » Tue, Aug 28, 2018, 6:07 PM UTC

mo3gut wrote: post #113

Qub3d wrote: post #89

I'm going to sorta break the prime directive and link the n-gate rebuttal to these articles: http://archive.fo/xcQ5j Its a bit heavy-handed, but it does bring up a good point: A lot of this argument for HTTPS-by-default is all on top of assumptions about who is responsible for data security. We're doing a lot and things are improving, but the general public still are all yelling at websites for misusing data that we…

> assumptions about who is responsible for data security. The chief assumption appears to be "anyone but the browser vendors". Let us consult the article: BeEF This, to me, was the most impactful demo Quite the endorsement. So what's BeEF's angle? "...examines exploitability within the context of the one open door: the web browser." There could hardly be a clearer expression of contempt for the browser vendors' offer…

Eh, there are two execution contexts here.

1. The web browser executing the injected data stream it receives from the remote computer.

2. Your brain interpreting 'non-executable' instructions as received from your browser.

Browser security has nothing to do with me going to 'xyz.com', which is the trusted website for xyz company, and being fed a MiTM telling me to go to a bad phone number for support.

Re: Why Static Websites Need HTTPS

#132

Post by trash_panda » Tue, Aug 28, 2018, 6:12 PM UTC

jakelazaroff wrote: post #130

trash_panda wrote: post #112

Earlier quoted context omitted.

This is important. Because the discussion around HTTPS tends to train users into think that HTTPS = Web Security. I totally agree that it's important, and I understand the attack vectors. But what about your outdated WordPress/Joomla installation? What about your default password on your admin site? Those I think are more serious issues, but of course harder to tackle. To exploit a MiTM you need to be on the same net…

> To exploit a MiTM you need to be on the same network, this could be achieved through your local-cafe's WiFi or by compromising an internal system of a local network. Or, say, your ISP injecting ads and tracking scripts into unencrypted pages your browser requests.

Holy, I forgot about that one! You're totally right and I'm surprised it's not one of the main arguments for this push for HTTPS.

Re: Why Static Websites Need HTTPS

#133

Post by Avamander » Tue, Aug 28, 2018, 6:13 PM UTC

EGreg wrote: post #74

People here are bringing up the difficulty for a regular user to set up HTTPS. I want to go one further: WHY does a regular user need to buy a human-readable domain name, maintain it, and pay for a hosting company to host on that domain? It used to be worse - you had to have your own machine or use some crappy shared hosting service. Amazon figured out that letting people share managed virtual machine instances was g…

> I want to go one further: WHY does a regular user need to buy a human-readable domain name, maintain it, and pay for a hosting company to host on that domain?

Because there's no interest in that. Getting a domain name is already cheap and easy.

> Storing chunks of encrypted data using Kademlia DHT or similar [...]

I've yet to see any P2P system have low latency, high speed and high reliability.

> All underlying URLs would be non-human-readable and clients would display (possibly outdated) metadata like an icon and title (this metadata may change on the Web anyway). Storing and sharing could occur using QR codes, NFC bluetooth, Javascript variables, or anything else. For static files, the links could be content-addressable.

Why?

> The only “downside” is the inability to type in a URL.

Good luck saying to your friend the nice webstore you got your hoodie from is [insert non-readable non-pronounceable url].

> and third party private ownership/stewardship of user-submitted content would be far less of a foregone conclusion

This is unacceptable for law enforcement

> If you are intrigued by this architecture, and want to learn more or possibly get involved, contact greg+qbix followed by @ qbix.com - we are BUILDING IT!

Oh this is an ad...

Re: Why Static Websites Need HTTPS

#134

Post by Avamander » Tue, Aug 28, 2018, 6:16 PM UTC

austincheney wrote: post #17

gsnedders wrote: post #5

Earlier quoted context omitted.

> One very serious argument that HTTPS evangelists avoid is when there is no content to protect the security benefits of HTTPS evaporate. My site is a web application that stores all user data in their browser. Their data does not come back to the server. The only thing that crosses the wire is a request for the application code and a response with that code. I would argue this model of application is substantially m…

No. https://en.wikipedia.org/wiki/Same-origin_policy

It's trivial to hijack an unencrypted connection to inject anything.

Re: Why Static Websites Need HTTPS

#135

Post by roblabla » Tue, Aug 28, 2018, 6:16 PM UTC

trash_panda wrote: post #115

schoen wrote: post #109

Earlier quoted context omitted.

> If Let's Encrypt is a malicious actor, they could MiTM a connection to your site, and present a VALID certificate to the target user, as they hold the private keys used to sign the public certificate. I'm not sure if you're referring to CAs' ability to issue fake certificates, or if you're suggesting that the certificate issuer can directly MITM connections. CAs' ability to issue fake certificates is a very serious…

Of course, you're right. My phrasing was not the best. The rogue CA would need to perform a classical MiTM as all the other mortals do, having access to the signing keys does not give you special MiTM powers, other than when you actually are able to conduct a MiTM through other means, you'll have valid certs to intercept the connection. Totally agree with your point about trust being a very hard problem to solve, tha…

Chrome requires certs to be published in CT to trust it[0], since chrome 68[1]. Because of this, I would believe CT is widely adopted.

[0]: http://www.certificate-transparency.org/certificate-transpar... , Certificate Inclusion Check

[1]: https://groups.google.com/a/chromium.org/forum/#!msg/ct-poli...

Re: Why Static Websites Need HTTPS

#136

Post by patrickmcmanus » Tue, Aug 28, 2018, 6:19 PM UTC

Ajedi32 wrote: post #118

tialaramex wrote: post #57

Earlier quoted context omitted.

https://www.usenix.org/system/files/conference/usenixsecurit... A big part of the problem here is that vendors do a _lousy_ job of making this easy. An out-of-box Apache is a fairly good HTTP server, but it'll take you an hour with a good tutorial to make it a half-way decent HTTPS server. Not because HTTPS is inherently difficult but because no relevant expertise was brought to bear in Apache's implementation. And t…

FWIW, Apache is getting native support for ACME certs: https://letsencrypt.org/2017/10/17/acme-support-in-apache-ht... Hopefully in the future more web servers will implement this, and HTTPS will be enabled as the default configuration.

That was one of my favorite Mozilla Open Source Support projects!

Re: Why Static Websites Need HTTPS

#137

Post by jancsika » Tue, Aug 28, 2018, 6:20 PM UTC

trash_panda wrote: post #115

schoen wrote: post #109

Earlier quoted context omitted.

> If Let's Encrypt is a malicious actor, they could MiTM a connection to your site, and present a VALID certificate to the target user, as they hold the private keys used to sign the public certificate. I'm not sure if you're referring to CAs' ability to issue fake certificates, or if you're suggesting that the certificate issuer can directly MITM connections. CAs' ability to issue fake certificates is a very serious…

Of course, you're right. My phrasing was not the best. The rogue CA would need to perform a classical MiTM as all the other mortals do, having access to the signing keys does not give you special MiTM powers, other than when you actually are able to conduct a MiTM through other means, you'll have valid certs to intercept the connection. Totally agree with your point about trust being a very hard problem to solve, tha…

> The rogue CA would need to perform a classical MiTM as all the other mortals do, having access to the signing keys does not give you special MiTM powers, other than when you actually are able to conduct a MiTM through other means, you'll have valid certs to intercept the connection.

But this thread is operating under the thought experiment that the NSA already owns LetsEncrypt. And in reality-- at least according to the Snowden leaks-- NSA currently has classical MiTM capabilities. (Can't remember which program it was that was using some node between the user and the desired server to send back a forged response that would almost always beat the server to the punch.)

So in this thought experiment there are only two pieces of Triforce and NSA has them both.

Re: Why Static Websites Need HTTPS

#138

Post by zaarn » Tue, Aug 28, 2018, 6:28 PM UTC

Avamander wrote: post #128

zaarn wrote: post #52

There is one static webpage that I won't put HTTPS on; the dashboard of my pi.hole. Though it's more of an architectural decision as it enables the DNS server to blackhole HTTPS more effectively (since it just gets a CONNREFUSED back). Really, it's an exception to the rule and only because I can't ask my guests to install my pihole CA on their devices (many of which don't support that stuff anyway). Well and there is…

You can buy a domain name and do DNS auth. Requires no open ports and you'll get a trusted cert for that one Pi. I did it for mine (but with SNI verification).

Pi.hole, it's only local and there is a reason it doesn't open port 443 and only works on 80. On a local non-wireless LAN this is not a concern in my threatmodel.

Re: Why Static Websites Need HTTPS

#139

Post by patrickmcmanus » Tue, Aug 28, 2018, 6:29 PM UTC

the post is good.. but also: confidentiality matters.

Think about a library. There are no secrets in the stacks that need to be kept from public disclosure. What is secret is the act of using the library - i.e. what they choose to read.

Re: Why Static Websites Need HTTPS

#140

Post by ss2003 » Tue, Aug 28, 2018, 6:31 PM UTC

MichaelApproved wrote: post #30

adwhit wrote: post #12

When I read things like that, I always think of the paper "The Rational Rejection of Security Advice by Users". [1] Yes, content injection is bad, but the chance of it happening multiplied by the damage it could cause to your users is probably less than the the effort required to shift a static blog site to HTTPS. (Do not underestimate the leap in difficulty from copy-pasting from an Nginx tutorial to understanding h…

Cpanel comes with easy to use Lets Encrypt module. Auto-new the certificate and sends optional email alerts each time it renews or fails. Web hosts are making it easy to use Lets Encrypt, which surprised me. I thought they'd be reluctant to give up the revenue from high margin certificate sales.

Not GoDaddy