[dead]
Stanford researchers find only 3% of HTTP runs on port 80 [pdf]
41–50 of 74 posts
Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]
#42Honestly I kind of dislike the security through scaring the userbase tactic. HTTPS is wonderful, but it is not needed in all situations. For your run of the mill static site, its essentially pointless. Sure, if you are dealing with money or customer data, use all the crypto you want. But I think people should respect tools should be applied where they are actually needed, not just arbitrarily. You dont need a bulletp…
I used to think like this, but then I read this:
Troy Hunt: Here's Why Your Static Website Needs HTTPS https://www.troyhunt.com/heres-why-your-static-website-needs...
Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]
#43At first this seemed surprising. Until you think about it more in-depth, port 80 is very much a privileged port that most applications don’t have permission to host on. Additionally, servers typically can have multiple HTTP services running in parallel and since you obviously can’t run two separate servers on the same port, it makes sense to avoid this conflict by running services on specialized ports. I don’t believ…
You can use reverse-proxying and have several servers behind a single front one.
Reverse proxies usually require configuration changes to work. Plus they are single points of failure. Server Name Indication (SNI) is a fairly recent development as well - any apps written before that was widespread, or designed in that way, will have a unique web server for every HTTP based service that has its own separately managed certificate.
Reverse proxying is less common in wild IoT devices, network appliances, and certain kinds of enterprise/line-of-business apps... Surprisingly Microsoft IIS seems to be an exception in that area
Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]
#44FYI HTTP traffic in the title specifically refers to unencrypted HTTP traffic. From the abstract:
> only 3% of HTTP and 6% of TLS services run on ports 80 and 443, respectively
I imagine the numbers would be a lot more extreme if you also somehow included non-public facing endpoints.
Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]
#45At first this seemed surprising. Until you think about it more in-depth, port 80 is very much a privileged port that most applications don’t have permission to host on. Additionally, servers typically can have multiple HTTP services running in parallel and since you obviously can’t run two separate servers on the same port, it makes sense to avoid this conflict by running services on specialized ports. I don’t believ…
>Additionally, servers typically can have multiple HTTP services running in parallel and since you obviously can’t run two separate servers on the same port,
Actually you can bind to the same port on different addresses. For loopback you have the entirety of 127.x.x.x
Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]
#46This is good right?
It is a neat fact, but nothing specifically good or bad.
Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]
#47It should be zero!
Who are the 3% of web service providers providing a web service on an unencrypted port on the open internet?!
Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]
#48Earlier quoted context omitted.
Right, but for a static site that’s publicly accessible, even HTTPS leaks the requested URL, any listener can go fetch that page themselves to see the contents.
> even HTTPS leaks the requested URL It does not. In the olden days the host name was leaked, but with SNI even that is gone. Anything past the first "/" is never and was never sent in plaintext in HTTPS
The host name is still leaked, SNI is not encrypted and ESNI is still not mandatory in TLS 1.3.
Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]
#49Earlier quoted context omitted.
Right, but for a static site that’s publicly accessible, even HTTPS leaks the requested URL, any listener can go fetch that page themselves to see the contents.
> even HTTPS leaks the requested URL It does not. In the olden days the host name was leaked, but with SNI even that is gone. Anything past the first "/" is never and was never sent in plaintext in HTTPS
> host name was leaked, but with SNI even that is gone
nope, you can still see it perfectly fine:
please don't spread misinformation.
Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]
#50Earlier quoted context omitted.
> even HTTPS leaks the requested URL It does not. In the olden days the host name was leaked, but with SNI even that is gone. Anything past the first "/" is never and was never sent in plaintext in HTTPS
> host name was leaked, but with SNI even that is gone nope, you can still see it perfectly fine: https://tlshello.agwa.name/ please don't spread misinformation.
ESNI*