Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS Everywhere will sunset in January 2023

eff.org

Post reply on HN
Print view View original

31–40 of 148 posts

Re: HTTPS Everywhere will sunset in January 2023

#31

Post by tialaramex »

my69thaccount wrote: post #14
DizzyDoo wrote: post #9

There's a piece of animation software that I use in my game development called Spine, and it's truly fantastic and the developers and staff are great... but the PHPBB forums don't have https enabled. I've brought it up on these same forums[0] but I don't think they get why https is an important thing to turn on, even in 2022. Turning on https mode in my browser brings up, as it should, a large error message saying th…

> Turning on https mode in my browser brings up, as it should, a large error message saying that the site is insecure. I can't imagine that's a terribly good first impression, even though, again, Spine is one of the best animation packages out there. A site being on HTTP isn't necessarily insecure. That warning is inaccurate. It's more about creating censors and gatekeepers in the form of certificate authorities. (De…

> A site being on HTTP isn't necessarily insecure. That warning is inaccurate.

The actual semantics of HTTP are very surprising to humans and this is a problem.

We have a whole bunch of systems - including some that are key to making HTTPS work such as OCSP, which rely on plain HTTP but those systems know about its semantics and account for them in how they work while ordinary users do not and shouldn't be expected to learn.

HTTPS delivers much closer to the semantics people actually expect, with the remaining exception being that people are often surprised that McDonalds.phishing.example isn't necessarily anything to do with McDonalds.

Re: HTTPS Everywhere will sunset in January 2023

#32

Post by DANK_YACHT »

superkuh wrote: post #29

HTTPS Everywhere being available in browsers as an option is great. HTTPS Everywhere being promoted as something you should have on by default is bad. HTTPS, like much else, relies on incorporated entities as certificate authorities. And that's fine for commercial interactions and if browsers were only for interacting with businesses. But by a combination of centralization in a few CAs (everyone uses LetsEncrypt now)…

HTTP is not ok. Anyone can ready / modify what is being sent. This privacy intrusion will definitely happen, whereas the risk of being banned by "some external corporation" is low. And, you always have the option of self-signing your own certificate, which is at least as secure as using HTTP, and much more secure if you can verify the certificate via a side channel.

Re: HTTPS Everywhere will sunset in January 2023

#33

Post by chrisweekly »

wlesieutre wrote: post #23
DizzyDoo wrote: post #19

Earlier quoted context omitted.

A slight correction here, the download of the exe does take place over https. As does buying the software, and signing up to the forums. But everything else doesn't? The software itself is some of the smoothest and most stable I've ever used. And when there's an update within the software that, as far as I'm aware, takes place over https too. But the rest of the site and forums, even when signed in, is http, and I do…

The download itself is over https, but the page where you click the download link is http. If someone were going to MITM the executable, they can just MITM the download page instead and point the download button to their own server with the bad executable.

Exactly; this is why mixed content is problematic, and the r'aison d'etre for HTTPS Everywhere.

Re: HTTPS Everywhere will sunset in January 2023

#34

Post by tialaramex »

kevincox wrote: post #25
theandrewbailey wrote: post #3

That was a good extension for a specific time. I stopped using it about 5 years ago when everyone had been pushing HTTPS hard, and Let's Encrypt had become popular. I didn't notice any websites not using HTTPS, so I didn't look back.

I've been using HTTPS-only mode on Firefox for many months now. The place where I see HTTP links most often is email tracking links. I'm commonly automatically upgraded to HTTPS and it works but very often there is no HTTPS support at all. Even for sensitive things like password resets that have secret tokens in the URL.

A few sites I run into once in a while have the following bad setup, which HTTPS-only flags (because it's actually unsafe) but looks normal to most people:

1. http://www.example.com/ exists and redirects to http://example.com/

2. http://example.com/ also exists and redirects to https://example.com/

3a https://example.com/ works fine but

3b https://www.example.com/ does not exist

4. External links go to http://www.example.com/stuff/goes/here

You will also see the mirror image mistake (www.example.com is canonical, but the redirects go from example.com only on HTTP) at similar rates.

This is all because Tim chose not to rely on SRV records to make his toy hypermedia system work and decades later we're still paying for this (among others) mistake.

Re: HTTPS Everywhere will sunset in January 2023

#35

Post by ZWoz »

DANK_YACHT wrote: post #32
superkuh wrote: post #29

HTTPS Everywhere being available in browsers as an option is great. HTTPS Everywhere being promoted as something you should have on by default is bad. HTTPS, like much else, relies on incorporated entities as certificate authorities. And that's fine for commercial interactions and if browsers were only for interacting with businesses. But by a combination of centralization in a few CAs (everyone uses LetsEncrypt now)…

HTTP is not ok. Anyone can ready / modify what is being sent. This privacy intrusion will definitely happen, whereas the risk of being banned by "some external corporation" is low. And, you always have the option of self-signing your own certificate, which is at least as secure as using HTTP, and much more secure if you can verify the certificate via a side channel.

> HTTP is not ok. Anyone can ready / modify what is being sent.

How do you plan demonstrate that in my local network, connection between my computer and printer web based interface? Generally, we had several decates HTTP as main protocol and that worked out.

Re: HTTPS Everywhere will sunset in January 2023

#36

Post by DANK_YACHT »

ZWoz wrote: post #35
DANK_YACHT wrote: post #32

Earlier quoted context omitted.

HTTP is not ok. Anyone can ready / modify what is being sent. This privacy intrusion will definitely happen, whereas the risk of being banned by "some external corporation" is low. And, you always have the option of self-signing your own certificate, which is at least as secure as using HTTP, and much more secure if you can verify the certificate via a side channel.

> HTTP is not ok. Anyone can ready / modify what is being sent. How do you plan demonstrate that in my local network, connection between my computer and printer web based interface? Generally, we had several decates HTTP as main protocol and that worked out.

The underlying assumption is that we're talking about the internet, not a private network, but even your private network would benefit from encryption. What is the benefit of having anyone with access to your network potentially read / modify your network traffic?

Re: HTTPS Everywhere will sunset in January 2023

#37

Post by superkuh »

DANK_YACHT wrote: post #32
superkuh wrote: post #29

HTTPS Everywhere being available in browsers as an option is great. HTTPS Everywhere being promoted as something you should have on by default is bad. HTTPS, like much else, relies on incorporated entities as certificate authorities. And that's fine for commercial interactions and if browsers were only for interacting with businesses. But by a combination of centralization in a few CAs (everyone uses LetsEncrypt now)…

HTTP is not ok. Anyone can ready / modify what is being sent. This privacy intrusion will definitely happen, whereas the risk of being banned by "some external corporation" is low. And, you always have the option of self-signing your own certificate, which is at least as secure as using HTTP, and much more secure if you can verify the certificate via a side channel.

It's like wearing a bulky level 3 bullet proof vest while you're at home cooking dinner. Yeah, it's keeping you safer. There's no doubt about that.

The real dangers on the web come from the insane behavior of running all arbitrary code sent to the browser from anywhere. Like opening every email attachment you get sent. NoScript temp whitelist only provides a lot more safety than HTTPS Everywhere and doesn't give all power to a few corporations.

Re: HTTPS Everywhere will sunset in January 2023

#38

Post by ZWoz »

DANK_YACHT wrote: post #36
ZWoz wrote: post #35

Earlier quoted context omitted.

> HTTP is not ok. Anyone can ready / modify what is being sent. How do you plan demonstrate that in my local network, connection between my computer and printer web based interface? Generally, we had several decates HTTP as main protocol and that worked out.

The underlying assumption is that we're talking about the internet, not a private network, but even your private network would benefit from encryption. What is the benefit of having anyone with access to your network potentially read / modify your network traffic?

Browsers are being pretty weak to understand difference between local networks vs internet. Lot of times I have seen hassle caused by HTTPS, be it printer or server baseboard management controller.

Re: HTTPS Everywhere will sunset in January 2023

#39

Post by DANK_YACHT »

superkuh wrote: post #37
DANK_YACHT wrote: post #32

Earlier quoted context omitted.

HTTP is not ok. Anyone can ready / modify what is being sent. This privacy intrusion will definitely happen, whereas the risk of being banned by "some external corporation" is low. And, you always have the option of self-signing your own certificate, which is at least as secure as using HTTP, and much more secure if you can verify the certificate via a side channel.

It's like wearing a bulky level 3 bullet proof vest while you're at home cooking dinner. Yeah, it's keeping you safer. There's no doubt about that. The real dangers on the web come from the insane behavior of running all arbitrary code sent to the browser from anywhere. Like opening every email attachment you get sent. NoScript temp whitelist only provides a lot more safety than HTTPS Everywhere and doesn't give all…

You need HTTPS to even begin trusting remote code. For instance, you download uMatrix to setup a whitelist. Where did uMatrix come from? If you downloaded it over HTTP, then you could be running anything. Even if you have a checksum for uMatrix, you can't trust it if you got the checksum over HTTP.

Now let's say you installed uMatrix and you want to trust a script. Well, how do you know that the script you downloaded came from the URL you've allowed? If you've requested this script before, then you can use a content hash, but if not, then you're basically blindly trusting that no one has tampered with the data.

Re: HTTPS Everywhere will sunset in January 2023

#40

Post by robjan »

silviot wrote: post #6
bombcar wrote: post #5

Earlier quoted context omitted.

http://neverssl.com remains for those badly-setup wifi networks.

Thanks! I'll stop using captive.apple.com now that I know about this!

You can also use example.com. I find that easier to remember.
Post reply on HN