Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plaintext HTTP in a Modern World

jcs.org

Post reply on HN
Print view View original

61–70 of 78 posts

Re: Plaintext HTTP in a Modern World

#61

Post by TingPing »

marginalia_nu wrote: post #58
shaicoleman wrote: post #56

Earlier quoted context omitted.

HTTPS isn't a panacea for all security issues. It ensures that when you connect to website.com, you'll get whatever website.com sends to you, without anyone else eavesdropping and tampering with the connection. HTTPS doesn't prevent you from going to weebsite.com. There are other security measures for that, but it's also your responsibility to check.

It doesn't even do the first thing. There are multiple vectors where someone could tamper or eavesdrop on a HTTPS connection, perhaps the biggest one being CDNs. As a visitor, you have no real idea how secure the connection is, even if it has a "padlock". HTTPS offers some protection against local attack vectors, from your ISP or on a public WiFi, but that's about it. The server could be compromised, or malicious, yo…

You keep sidestepping the benefits. You want website.com you get website.com. It's impossible to know the infrastructure of that website and simply isn't something HTTPS will fix. That's more of a social/legal problem of how companies can handle user data.

Re: Plaintext HTTP in a Modern World

#62

Post by TingPing »

marginalia_nu wrote: post #59
LunaSea wrote: post #57

Earlier quoted context omitted.

Because random ISPs will inject ads in websites for example.

That seems like a poor choice of ISP to me. If I dial my phone and have to listen to ad jingles before it connects, I'm changing my phone company.

That type of response comes from a place of privilege. Many have no choice over ISP.

Re: Plaintext HTTP in a Modern World

#63

Post by marginalia_nu »

TingPing wrote: post #62
marginalia_nu wrote: post #59

Earlier quoted context omitted.

That seems like a poor choice of ISP to me. If I dial my phone and have to listen to ad jingles before it connects, I'm changing my phone company.

That type of response comes from a place of privilege. Many have no choice over ISP.

Dysfunctional markets is a legal problem, not a technical one. Concealing the consequences of market dysfunction with technological band-aids only serves to preserve the status quo.

Re: Plaintext HTTP in a Modern World

#64

Post by marginalia_nu »

TingPing wrote: post #61
marginalia_nu wrote: post #58

Earlier quoted context omitted.

It doesn't even do the first thing. There are multiple vectors where someone could tamper or eavesdrop on a HTTPS connection, perhaps the biggest one being CDNs. As a visitor, you have no real idea how secure the connection is, even if it has a "padlock". HTTPS offers some protection against local attack vectors, from your ISP or on a public WiFi, but that's about it. The server could be compromised, or malicious, yo…

You keep sidestepping the benefits. You want website.com you get website.com. It's impossible to know the infrastructure of that website and simply isn't something HTTPS will fix. That's more of a social/legal problem of how companies can handle user data.

The benefits are pretty small compared to the cost of requiring HTTPS everywhere, which is allowing silicon valley to bully the entire internet into jumping through its hoops to get traffic.

The websites that aren't willing or able to do so are, in my experience, some of the more precious ones we have on the Internet. The websites that aren't trying to monetize their visitors are the ones that get Thanos:ed out of apparent existence. What gets lost isn't the spam or the malicious websites, they of course adapt. What gets lost is the unique views, the personal websites, like from some 80 year old who has meticulously published a catalogue of his astrolabe collection online over the last 30 years.

Re: Plaintext HTTP in a Modern World

#65

Post by afiori »

aliraheem wrote: post #4
superkuh wrote: post #2

Everything in this article rings true. But there's more. HTTPS only, combined with almost everyone only using LetsEncrypt (a great service), leads to massive concentration of value for any internal corruption at LE or external political (or other) pressures on LE. The more browsers refuse to show HTTP, the more people in LE, the greater prize it is for those that want to control what is seen. If you want the web to b…

I may be wrong, but as I understand it HTTPS connections typically use an ephemeral key with the certificate used to authenticate the servers identity. So simply having the certificate does not mean one can read the traffic without conducting a man-in-the-middle attack. This means that anyone who could read traffic from a HTTPS connection could read it from a HTTP connection just as easy. The arguement seems to boil…

> The arguement seems to boil down to, everyone uses a master lock, some people can open master locks, please consider leaving your locker unlocked... why?

In fairness it should be more of "everyone uses a master lock, some people can open master locks, please consider not making master locks own 90% of the locks"

Re: Plaintext HTTP in a Modern World

#66

Post by jbotdev »

astrobe_ wrote: post #53
jbotdev wrote: post #6

Not sure I understand the concern about access from “modern embedded devices”. Something like a Raspberry Pi, or really anything with a decent ARM processor, can easily handle TLS.

The word "modern" in the phrase is dumb -- as usual with the word modern ; it's on of those word that convey no real meaning most of the times. It's not about modern , it's about power. Current 32bits SoCs prolly sale for the same price as 16bits systems of a decade ago, so yes, they probably can handle HTTP. However, 8 and 16 bits microcontrollers with only a few kb of RAM/Flash are still made ("modernly"), sold and…

You would definitely have trouble on an 8-bit micro, but I wouldn’t expect to browse a “personal website” with one of those, which is what the article seems to focus on. Maybe a “personal HTTP API” at best.

Re: Plaintext HTTP in a Modern World

#67

Post by TingPing »

marginalia_nu wrote: post #63
TingPing wrote: post #62

Earlier quoted context omitted.

That type of response comes from a place of privilege. Many have no choice over ISP.

Dysfunctional markets is a legal problem, not a technical one. Concealing the consequences of market dysfunction with technological band-aids only serves to preserve the status quo.

This is just a deeply unhelpful way to think.

Firstly it punishes those in the worst situations. Those in countries with abusive political systems, those who have no legal representation, etc.

I don't even believe the idea is right in practice "serves to preserve the status quo" is just wrong in this case. HTTPS completely breaks most terrible things ISPs can do. It completely dismantles the system.

Re: Plaintext HTTP in a Modern World

#68

Post by marginalia_nu »

TingPing wrote: post #67
marginalia_nu wrote: post #63

Earlier quoted context omitted.

Dysfunctional markets is a legal problem, not a technical one. Concealing the consequences of market dysfunction with technological band-aids only serves to preserve the status quo.

This is just a deeply unhelpful way to think. Firstly it punishes those in the worst situations. Those in countries with abusive political systems, those who have no legal representation, etc. I don't even believe the idea is right in practice "serves to preserve the status quo" is just wrong in this case. HTTPS completely breaks most terrible things ISPs can do. It completely dismantles the system.

> Firstly it punishes those in the worst situations. Those in countries with abusive political systems, those who have no legal representation, etc.

HTTPS offers virtually no defense against a state actor.

> I don't even believe the idea is right in practice "serves to preserve the status quo" is just wrong in this case. HTTPS completely breaks most terrible things ISPs can do. It completely dismantles the system.

HTTPS doesn't dismantle the system at all. You're still stuck with no other option for an ISP, which means you are not going to get favorable terms. And even with HTTPS, you need to look up the IP for the servers you're going to visit, and ISPs can snoop on your DNS traffic and sell information about how you, the IP (or the person), regularly looks up the IP for abortionpills.example.com (or connects to the IP associated with the server).

Re: Plaintext HTTP in a Modern World

#69

Post by tadfisher »

nicoco wrote: post #36
kgeist wrote: post #7

>While this push for security is good for protecting modern communication, there is a whole web full of information and services that don’t need to be secured It's not only about security. I wonder if it happens in other countries too - here in Russia ISPs used to inject advertisements directly into HTTP traffic which was very annoying and now they inject propaganda justifying the war. Fortunately very few sites use…

The author is aware of this. At the bottom of the article: > Please don’t contact me to “well ackchyually” me and explain MITM attacks and how your terrible ISP inserts ads into your unencrypted web pages

... which in no way addresses the issue.

Again, a proxy solves the problem for old devices without sacrificing security.

Re: Plaintext HTTP in a Modern World

#70

Post by KronisLV »

Lex-2008 wrote: post #51
KronisLV wrote: post #20

Earlier quoted context omitted.

> HTTPS only, combined with almost everyone only using LetsEncrypt (a great service), leads to massive concentration of value for any internal corruption at LE or external political (or other) pressures on LE. Well where are all the other free SSL/TLS certificate providers, then? ZeroSSL sometimes gets mentioned, though they are also pretty keen to charge you, which is the exact reason why many go for Let's Encrypt:…

well, to be fair, https://zerossl.com/pricing/ has a "free" column :) On the other page, https://zerossl.com/features/acme/ it looks like free acme certificates can have a wildcard records (*.example.com). https://www.sslforfree.com/ claims they use zerossl and support wildcard records. Also, one of others you mentioned also has a free acme option, but without mentioning wildcards: https://www.ssl.com/how-to/order-fr…

Upon a closer look, it indeed seems that the certificate count limitations apply to the manually requisitioned certificates, not the ACME ones:

> By using ZeroSSL's ACME feature, you will be able to generate an unlimited amount of 90-day SSL certificates at no charge, also supporting multi-domain certificates and wildcards. Each certificate you create will be stored in your ZeroSSL account.

So I guess that's a viable option.

Post reply on HN