Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Should All Web Traffic Be Encrypted?

codinghorror.com

Post reply on HN
Print view View original

71–80 of 136 posts

Re: Should All Web Traffic Be Encrypted?

#71

Post by chc »

rogerbinns wrote: post #61
SoftwareMaven wrote: post #47

Just Tuesaday, I sent an email around the company discussing SSL vulnerabilities, how they impact our product, and ways we can mitigate that. I've pulled out the parts specific to our product, but the rest may be interesting. I would love feedback on things I may have missed. FWIW, it doesn't instill great confidence in SSL, but it isn't completely horrible. ------------------------ 1. It is possible to pretend to be…

Expanding on 1) you can also play man in the middle, decrypt and resign traffic with your own faked CA. If you ever have access to the users' machine you can install your faked CA as trusted and could have done it long in advance (eg via trojans/viruses). When I was working on WAN optimizers I actually did this during research. All the various sites I visited still proudly told me how they were "Verisign Trusted" and…

If you've already owned the box, why would you bother with MITM?

Re: Should All Web Traffic Be Encrypted?

#72

Post by Andrex »

mukyu wrote: post #40
Andrex wrote: post #22

Earlier quoted context omitted.

That's not the same thing though. Plain text is a security risk because users tend to reuse passwords. If it's hashed then that wouldn't be the case, even if they can mine it or whatever.

What the hell are you talking about? Google is not storing hashes of your emails instead of the emails. How is anything under discussion related to passwords?

I'm sorry, I misunderstood. The parent comment didn't mention emails being in plaintext, but just "Gmail." I took that as meaning passwords.

Re: Should All Web Traffic Be Encrypted?

#73

Post by irahul »

ANH wrote: post #19
jmitcheson wrote: post #12

Earlier quoted context omitted.

You know it's become a huge internet meme right? http://www.google.com.au/search?q=x+all+the+things&oq=x+... .

Missed that one. Too busy reading Hacker N -- I mean, writing code. And the meme-ification only makes me feel slightly better about it. I mean, what's it cost Jeff to give a little credit?

There is a good chance Jeff doesn't know about the source, and generated using one of the meme generator sites.

Re: Should All Web Traffic Be Encrypted?

#75

Post by gurkendoktor »

TomGullen wrote: post #45

Lesser known HTTP feature that I love, instead of linking to resources like follows: http://static4.scirra.net/images/favicon.ico /> You should link as follows: The double forward slash will select the current protocol the page is being viewed on which means no security errors if you're switching between http/https!

I always expected this to do the same:

If it doesn't, then what does it do? Default to http?

Re: Should All Web Traffic Be Encrypted?

#76

Post by SoftwareMaven »

chc wrote: post #71
rogerbinns wrote: post #61

Earlier quoted context omitted.

Expanding on 1) you can also play man in the middle, decrypt and resign traffic with your own faked CA. If you ever have access to the users' machine you can install your faked CA as trusted and could have done it long in advance (eg via trojans/viruses). When I was working on WAN optimizers I actually did this during research. All the various sites I visited still proudly told me how they were "Verisign Trusted" and…

If you've already owned the box, why would you bother with MITM?

In the corporate world, it is used a lot for data loss prevention policies. It keeps employees from sending a file containing all their customers' social security numbers, addresses, and credit card to their home email account (or even one of them).

Re: Should All Web Traffic Be Encrypted?

#77

Post by eurleif »

gurkendoktor wrote: post #75
TomGullen wrote: post #45

Lesser known HTTP feature that I love, instead of linking to resources like follows: http://static4.scirra.net/images/favicon.ico /> You should link as follows: The double forward slash will select the current protocol the page is being viewed on which means no security errors if you're switching between http/https!

I always expected this to do the same: If it doesn't, then what does it do? Default to http?

That's a relative URL. It would be equivalent to http://static4.scirra.net/static4.scirra.net/images/favicon....

Re: Should All Web Traffic Be Encrypted?

#78

Post by mkjones »

harryh wrote: post #55

One item that this (excellent) blog post does not adress is what to do about referer information which is generally not passed along when clicking on links on sites being browsed over SSL. In order to "get credit" for all of the traffic that they send everywhere twitter had to develop a fairly elaborate system of redirections (built into t.co) to make sure that clicks from twitter.com ended up being sent out to the r…

Yeah, this is a bit of a pain. We have to something similar for facebook (https://www.facebook.com/note.php?note_id=10150492832835766). There's talk of a meta referrer tag (http://wiki.whatwg.org/wiki/Meta_referrer) that would allow overriding this behavior and making things a lot simpler, but afaik it's not implemented in any of the major browsers.

Re: Should All Web Traffic Be Encrypted?

#79

Post by richardw »

ANH wrote: post #19
jmitcheson wrote: post #12

Earlier quoted context omitted.

You know it's become a huge internet meme right? http://www.google.com.au/search?q=x+all+the+things&oq=x+... .

Missed that one. Too busy reading Hacker N -- I mean, writing code. And the meme-ification only makes me feel slightly better about it. I mean, what's it cost Jeff to give a little credit?

He likely made it here:

http://www.quickmeme.com/All-The-Things/

I wouldn't have known where it originated from. It's possible/likely the source gave them permission to use it.

Re: Should All Web Traffic Be Encrypted?

#80

Post by AgentConundrum »

sp332 wrote: post #20

I use the EFF's Firefox addon called "HTTPS Everywhere". It has a list of websites that have HTTPS enabled, and whenever your browser is directed to the plain-HTTP version, it will go to the HTTPS version instead. https://www.eff.org/https-everywhere A useful (but tbh kinda annoying) companion addon is the HTTPS Finder. It checks to see if the website you're currently browsing also has an HTTPS version, and will add…

Thanks for mentioning this.

I've been using HTTPS Everywhere for a while now, but it's been almost entirely a vanilla install since I got it. The only exception so far has been HN itself, and only because someone put the new rule in a comment. I then had to use Google to find out how to actually install the rule, as it was pretty non-obvious to me.

Post reply on HN