Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stanford researchers find only 3% of HTTP runs on port 80 [pdf]

lizizhikevich.github.io

Post reply on HN
Print view View original

11–20 of 74 posts

Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]

#11

Post by ViVr »

2h wrote: post #6

Honestly I kind of dislike the security through scaring the userbase tactic. HTTPS is wonderful, but it is not needed in all situations. For your run of the mill static site, its essentially pointless. Sure, if you are dealing with money or customer data, use all the crypto you want. But I think people should respect tools should be applied where they are actually needed, not just arbitrarily. You dont need a bulletp…

HTTPS improves security even for a static site because it prevents an ISP or middleman from injecting ads (or worse) into the page.

It also increases privacy because the contents of the traffic can not be observed by third parties.

Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]

#12

Post by Taek »

2h wrote: post #6

Honestly I kind of dislike the security through scaring the userbase tactic. HTTPS is wonderful, but it is not needed in all situations. For your run of the mill static site, its essentially pointless. Sure, if you are dealing with money or customer data, use all the crypto you want. But I think people should respect tools should be applied where they are actually needed, not just arbitrarily. You dont need a bulletp…

I don't want to pile on, but security vulnerabilities are often composed of a series of seemingly insignificant weaknesses that get chained together in highly clever ways. Anything that is accessed over http gives a potential attacker the ability to monitor activity, MitM, spread misinformation, and find potential other footholds that can be composed into a larger attack.

Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]

#13

Post by marpstar »

ViVr wrote: post #11
2h wrote: post #6

Honestly I kind of dislike the security through scaring the userbase tactic. HTTPS is wonderful, but it is not needed in all situations. For your run of the mill static site, its essentially pointless. Sure, if you are dealing with money or customer data, use all the crypto you want. But I think people should respect tools should be applied where they are actually needed, not just arbitrarily. You dont need a bulletp…

HTTPS improves security even for a static site because it prevents an ISP or middleman from injecting ads (or worse) into the page. It also increases privacy because the contents of the traffic can not be observed by third parties.

Right, but for a static site that’s publicly accessible, even HTTPS leaks the requested URL, any listener can go fetch that page themselves to see the contents.

Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]

#14

Post by extheat »

At first this seemed surprising. Until you think about it more in-depth, port 80 is very much a privileged port that most applications don’t have permission to host on. Additionally, servers typically can have multiple HTTP services running in parallel and since you obviously can’t run two separate servers on the same port, it makes sense to avoid this conflict by running services on specialized ports. I don’t believe the intention for most hosts is to keep the service secret by running it on a non standard port.

Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]

#15

Post by dmitrygr »

marpstar wrote: post #13
ViVr wrote: post #11

Earlier quoted context omitted.

HTTPS improves security even for a static site because it prevents an ISP or middleman from injecting ads (or worse) into the page. It also increases privacy because the contents of the traffic can not be observed by third parties.

Right, but for a static site that’s publicly accessible, even HTTPS leaks the requested URL, any listener can go fetch that page themselves to see the contents.

> even HTTPS leaks the requested URL

It does not. In the olden days the host name was leaked, but with SNI even that is gone. Anything past the first "/" is never and was never sent in plaintext in HTTPS

Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]

#16

Post by snowwrestler »

marpstar wrote: post #13
ViVr wrote: post #11

Earlier quoted context omitted.

HTTPS improves security even for a static site because it prevents an ISP or middleman from injecting ads (or worse) into the page. It also increases privacy because the contents of the traffic can not be observed by third parties.

Right, but for a static site that’s publicly accessible, even HTTPS leaks the requested URL, any listener can go fetch that page themselves to see the contents.

HTTPS does not leak the requested URL to servers between the client and the server.

Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]

#17

Post by cperciva »

dmitrygr wrote: post #15
marpstar wrote: post #13

Earlier quoted context omitted.

Right, but for a static site that’s publicly accessible, even HTTPS leaks the requested URL, any listener can go fetch that page themselves to see the contents.

> even HTTPS leaks the requested URL It does not. In the olden days the host name was leaked, but with SNI even that is gone. Anything past the first "/" is never and was never sent in plaintext in HTTPS

Most public web sites leak information about page accesses to anyone who can count bytes.

Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]

#19

Post by Turskarama »

autoexec wrote: post #5

> Services on unexpected ports are more likely to be insecure than services on assigned ports. That line really surprised me. I'd have thought that somebody who knows enough to move a frequently targeted service to a different port to avoid low effort attacks/scans would know enough to use other protections, then I saw it was partly because of cheap IoT devices that have zero issues violating specifications out of th…

It doesn't surprise me _at all_. Security through obscurity doesn't work, if you have real security you wouldn't bother using another port because there's no (security) reason to do so.

If someone is trying to use ports as their security measure then it's because they don't actually know how to make their API secure properly.

Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]

#20

Post by somat »

2h wrote: post #6

Honestly I kind of dislike the security through scaring the userbase tactic. HTTPS is wonderful, but it is not needed in all situations. For your run of the mill static site, its essentially pointless. Sure, if you are dealing with money or customer data, use all the crypto you want. But I think people should respect tools should be applied where they are actually needed, not just arbitrarily. You dont need a bulletp…

Agree, what I dislike most about https is the way it effectively has a forced expiry date. Have you ever stumbled across someones old abandoned university project page, a blast from the past with all sorts of interesting information. hopes and dreams from a bygone era. not gonna happen with https.
Post reply on HN