Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encrypted web traffic now exceeds 90%

netmarketshare.com

Post reply on HN
Print view View original

61–70 of 311 posts

Re: Encrypted web traffic now exceeds 90%

#61

Post by taftster »

deaps wrote: post #39
a13n wrote: post #27

Earlier quoted context omitted.

It is just as secure, you get nothing more by paying.

So for my personal projects, I use lets encrypt. As far as I know (and I could be wrong now, haven't checked in a while) - their certs are only good for 3 months. Which is simple enough to get around - run a script on your box that updates the cert every 90 days automatically. At work, we use a paid certificate that is good for a longer period of time (normally a year). So that's one benefit to paying, I suppose. As…

The fact that Let's Encrypt certificates expire quickly is a feature, not anything to do with paid vs. non-paid.

Let's Encrypt could have just as easily generated certificates good for a year or more. But the point of Let's Encrypt is to force you to do this in an automated way, using scripts like you suggest.

You're not getting around anything. The choice was by design.

https://letsencrypt.org/2015/11/09/why-90-days.html

Re: Encrypted web traffic now exceeds 90%

#63

Post by tantalor »

est31 wrote: post #60

While this milestone is wonderful, don't forget that it can't be decrypted for now . IMO we trust contemporary encryption algorithms too much, putting too much data through the wires that will only increase in value. We aren't at the end of the evolution either: we still don't have really secure random generators everywhere, we are still using key exchange methods that aren't quantum proof. And of course, computer pr…

Encryption is worthless without properly enforcing it. How easy is it to trick your victim's bank into granting you access with a SIM swap? We need 2FA everywhere and stop relying on SMS for authentication.

Re: Encrypted web traffic now exceeds 90%

#64

Post by acid__ »

tantalor wrote: post #63
est31 wrote: post #60

While this milestone is wonderful, don't forget that it can't be decrypted for now . IMO we trust contemporary encryption algorithms too much, putting too much data through the wires that will only increase in value. We aren't at the end of the evolution either: we still don't have really secure random generators everywhere, we are still using key exchange methods that aren't quantum proof. And of course, computer pr…

Encryption is worthless without properly enforcing it. How easy is it to trick your victim's bank into granting you access with a SIM swap? We need 2FA everywhere and stop relying on SMS for authentication.

I agree that we need 2FA and that we shouldn't rely on SMS. That said, saying encryption is worthless because other threat vectors exist is a bit hyperbolic. Security is all about defense in layers. There's several orders of magnitude difference in the difficulty of performing a SIM swap attack vs sucking up passwords on coffee shop wifi.

Re: Encrypted web traffic now exceeds 90%

#65

Post by Jonnax »

r1ch wrote: post #31
Jonnax wrote: post #11

Nice. Remember the days when IT professionals would exclaim that this was a bad idea? Seems like it's cyclical thing. DNS over HTTPS is now the big bad technology.

DoH /is/ a bad technology on a technical level. On a modern network DNS requests come in pretty much constantly and I've never seen so many DNS timeouts and slow lookups as when I tried running a DoH proxy for my LAN. The head of line blocking of HTTP / TCP is horrible and my router was running at 100% CPU with all the TLS overhead. I'm all for authenticated and encrypted DNS but routing it over HTTPS is just a nasty…

It seems like it's a problem with your router not being able to handle TLS. Old equipment doesnt last forever.

HTTP is the internet, and the amount requests a client makes is magnitudes greater than DNS.

Like Google or Cloudfare's DoH isn't slow.

Re: Encrypted web traffic now exceeds 90%

#66

Post by edm0nd »

tantalor wrote: post #63
est31 wrote: post #60

While this milestone is wonderful, don't forget that it can't be decrypted for now . IMO we trust contemporary encryption algorithms too much, putting too much data through the wires that will only increase in value. We aren't at the end of the evolution either: we still don't have really secure random generators everywhere, we are still using key exchange methods that aren't quantum proof. And of course, computer pr…

Encryption is worthless without properly enforcing it. How easy is it to trick your victim's bank into granting you access with a SIM swap? We need 2FA everywhere and stop relying on SMS for authentication.

All banks should adopt U2F and hopefully sooner than later :)

Re: Encrypted web traffic now exceeds 90%

#67

Post by gambler »

I don't know why so many people here are patting themselves on the back over this. This is not the kind of encryption people were talking about in the 90s and 00s. A lot of this encryption is not point-to-point. It merely secures user's interaction with some middleman (or their server). What would the numbers be if you subtracted all the traffic that can be snooped on by Google, Amazon and Cloudflare?

Re: Encrypted web traffic now exceeds 90%

#68

Post by input_sh »

mholt wrote: post #5

Good news for sure, but note that this isn't a total Internet scan: > We collect data from the browsers of site visitors to our exclusive on-demand network of analytics and social bookmarking products. More details about their samples: https://netmarketshare.com/methodology I would be more inclined to trust sources like https://transparencyreport.google.com/https/overview and Firefox Telemetry which come directly fro…

> from mobile apps (most of which have to be encrypted now I think)

Since the end of 2016 on iOS and since Android v9, apps have to communicate over HTTPS. I guess you can technically visit HTTP sites via a browser, but I'd bet that >90% of the traffic from smartphones is over HTTPS.

Re: Encrypted web traffic now exceeds 90%

#70

Post by patrickmcnamara »

tomschlick wrote: post #3
chrisweekly wrote: post #2

Awesome! Any idea how much of that is attributable to LetsEncrypt and HTTPSEverywhere?

It's probably more attributed to browsers marking non-https as 'Not Secure' than anything but LetsEncrypt definitely has had a substantial impact to make that change possible.

I don't think any of my personal websites be HTTPS without LetsEncrypt. It's great for that use case.
Post reply on HN