Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stanford researchers find only 3% of HTTP runs on port 80 [pdf]

lizizhikevich.github.io

Post reply on HN
Print view View original

61–70 of 74 posts

Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]

#61

Post by Rewrap3643 »

Am4TIfIsER0ppos wrote: post #53
2h wrote: post #6

Honestly I kind of dislike the security through scaring the userbase tactic. HTTPS is wonderful, but it is not needed in all situations. For your run of the mill static site, its essentially pointless. Sure, if you are dealing with money or customer data, use all the crypto you want. But I think people should respect tools should be applied where they are actually needed, not just arbitrarily. You dont need a bulletp…

Everyone else replying is a shill of one sort or another. Someone might inject javascript into the page? You should not be allowing RCE anyway. Someone might MITM? Cloudflare does this with https anyway. Companies might spy on you? They already are. Cloudflare intercepts all the traffic going to them despite it being encrypted. Government might spy on you? They already are. They have backdoors and frontdoors into eve…

What would you propose then?

Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]

#62

Post by Qwertysjsjs »

extheat wrote: post #14

At first this seemed surprising. Until you think about it more in-depth, port 80 is very much a privileged port that most applications don’t have permission to host on. Additionally, servers typically can have multiple HTTP services running in parallel and since you obviously can’t run two separate servers on the same port, it makes sense to avoid this conflict by running services on specialized ports. I don’t believ…

Or it's just that the let's encrypt topic and https per Default and getting down ranked on Google when using http makes 80 just a really really bad option.

My company blocks port 80 globally and I only learned about it through an internal service I configures. Which shows how little normal day to day traffic is http and port 80.

Also when the https topic came up, quite a lot of big hosters (shops, crms, website hosting) started to give you https which was NOT normal before.

Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]

#63

Post by webmaven »

autoexec wrote: post #5

> Services on unexpected ports are more likely to be insecure than services on assigned ports. That line really surprised me. I'd have thought that somebody who knows enough to move a frequently targeted service to a different port to avoid low effort attacks/scans would know enough to use other protections, then I saw it was partly because of cheap IoT devices that have zero issues violating specifications out of th…

Remember, the 'S' in IoT stands for 'security'.

Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]

#64

Post by Am4TIfIsER0ppos »

Rewrap3643 wrote: post #61
Am4TIfIsER0ppos wrote: post #53

Earlier quoted context omitted.

Everyone else replying is a shill of one sort or another. Someone might inject javascript into the page? You should not be allowing RCE anyway. Someone might MITM? Cloudflare does this with https anyway. Companies might spy on you? They already are. Cloudflare intercepts all the traffic going to them despite it being encrypted. Government might spy on you? They already are. They have backdoors and frontdoors into eve…

What would you propose then?

Specifically? Firefox to stop bitching that I enter my passwords into unencrypted pages on my local network. Browsers halt or even reverse their plans of deprecating unencrypted transport. Browsers stop bitching about loading unencrypted static resources on an encrypted page.

Generally? Everyone I accused of being shills off the "everything encrypted" bandwagon. If you want to encrypt your websites go ahead. You don't have to believe my unhinged conspiracies from earlier.

Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]

#65

Post by nailer »

extheat wrote: post #14

At first this seemed surprising. Until you think about it more in-depth, port 80 is very much a privileged port that most applications don’t have permission to host on. Additionally, servers typically can have multiple HTTP services running in parallel and since you obviously can’t run two separate servers on the same port, it makes sense to avoid this conflict by running services on specialized ports. I don’t believ…

> port 80 is very much a privileged port that most applications don’t have permission to host on

setcap 'cap_net_bind_service=+ep' /path/to/program

But yes, until like the last 10 years or so. Also while it's possible nobody knows this information.

More interestingly, port 7475 (which is the most popular port besides 80 and 443) is set top boxes watching TV.

Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]

#66

Post by tredre3 »

Am4TIfIsER0ppos wrote: post #64
Rewrap3643 wrote: post #61

Earlier quoted context omitted.

What would you propose then?

Specifically? Firefox to stop bitching that I enter my passwords into unencrypted pages on my local network. Browsers halt or even reverse their plans of deprecating unencrypted transport. Browsers stop bitching about loading unencrypted static resources on an encrypted page. Generally? Everyone I accused of being shills off the "everything encrypted" bandwagon. If you want to encrypt your websites go ahead. You don'…

> Browsers stop bitching about loading unencrypted static resources on an encrypted page.

I tend to agree with you on other points but that one is a weird take. If I deliberately visit an https page I want to be reasonably confident that it wasn't tampered with and that I'm not leaking information.

Allowing loading http resources in an https context breaks that trust. Scripts may be tampered with. The website URL is leaked via the referer. Cookies might be leaked.

Note: Mitigations for all those worries do exist. Cookies can be flagged secure-only. Referer can be stopped using CORS, etc. But they all need the developer to be proactive about it and, for the most part, they aren't.

Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]

#67

Post by JohnFen »

Turskarama wrote: post #40
0cf8612b2e1e wrote: post #23

Earlier quoted context omitted.

>if you have real security you wouldn't bother using another port because there's no (security) reason to do so. Strong disagree with that. If you do something as simple as moving SSH to a different port, the number of drive-by attacks will drop enormously. Raises the signal to noise of all connection attempts in the logs.

I guess that's true, but that's not a security reason.

Sure it is. Running on a nonstandard port is absolutely as adequate of a security measure as locking a screen door. But it does filter out a fair number of probes, and reducing the number of probes does increase your security.

So it's like locking the screen door in front of your reinforced, deadbolted door. Some people will try the screen door, find it locked, and move on. It doesn't do a lot, but it's not entirely worthless, either.

Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]

#68

Post by JohnFen »

vbezhenar wrote: post #35
Dylan16807 wrote: post #29

Earlier quoted context omitted.

Why doesn't yours? What do you mean by "soon"? I just tried http://example.com/ in chrome canary and it's the same. Edit: Okay, I found the "Always use secure connections" setting, but that has been around for a while. And it doesn't actually stop me, it asks. Also downloads are or will be blocked on http but that's not too bad of an idea.

An invalid certificate also doesn't technically stops you and just asks if you really want to proceed. By "soon" I mean that this particular behavior surely will be the default one. Here's old blog post: https://blog.chromium.org/2021/03/a-safer-default-for-naviga... And quote from it: "HTTPS protects users by encrypting traffic sent over the network, so that sensitive information users enter on websites cannot be in…

Any browser that actively prevents viewing an HTTP site is not fit for purpose. Set secure defaults, absolutely. Show scary warning pages if you insist. But don't prevent legitimate activity entirely.

Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]

#69

Post by JohnFen »

bqmjjx0kac wrote: post #8
2h wrote: post #6

Honestly I kind of dislike the security through scaring the userbase tactic. HTTPS is wonderful, but it is not needed in all situations. For your run of the mill static site, its essentially pointless. Sure, if you are dealing with money or customer data, use all the crypto you want. But I think people should respect tools should be applied where they are actually needed, not just arbitrarily. You dont need a bulletp…

Which part of confidentiality/integrity/authenticity is unnecessary for a static site?

Static sites serving on a local network that is never exposed to the internet.

Re: Stanford researchers find only 3% of HTTP runs on port 80 [pdf]

#70

Post by jiggawatts »

extheat wrote: post #14

At first this seemed surprising. Until you think about it more in-depth, port 80 is very much a privileged port that most applications don’t have permission to host on. Additionally, servers typically can have multiple HTTP services running in parallel and since you obviously can’t run two separate servers on the same port, it makes sense to avoid this conflict by running services on specialized ports. I don’t believ…

Windows has long had the capability to share TCP ports between applications: https://learn.microsoft.com/en-us/dotnet/framework/wcf/featu...
Post reply on HN