Should All Web Traffic Be Encrypted? • Hacker News Board

Re: Should All Web Traffic Be Encrypted?

#131

Post by rplnt » Fri, Feb 24, 2012, 9:57 PM UTC

pavel_lishin wrote: post #119

rplnt wrote: post #107

Earlier quoted context omitted.

> If HTTP referrers never existed, the web would still be huge and would still be full of amazing content. While we're at it, let's get rid of User-Agent. No sarcasm intended, I'm serious. It only does bad things.

I disagree - it's nice to be able to serve a mobile layout to a mobile device. If I'm trying to load, say, CNN or ESPN on an older mobile phone, I don't need all the cruft that comes with the desktop version. (We can get into all the evils suggested by http://xkcd.com/869/ , but for the purposes of this argument I'm assuming that web developers and sysadmins are competent and not evil.)

And then you get served mobile version of the site because you are using Opera and some incompetent web developer[1] decided that it's a mobile browser. But you got a point. However, deciding what to show should be based on the device (resolution, size, orientation, input methods, ...) and not the browser.

Now, just for fun and laughs, check out what user-agent string is sent by Chrome. I guess Google assumes everyone is like them and their poor browser would get blocked if they just said it's a Chrome.

1. https://groups.google.com/a/googleproductforums.com/d/topic/...

Re: Should All Web Traffic Be Encrypted?

#132

Post by mirkules » Sat, Feb 25, 2012, 1:48 AM UTC

marshray wrote: post #62

wisty wrote: post #49

Earlier quoted context omitted.

Ironic, but there's virtually nothing private on SO.

Training users to click-through security warnings diminishes the security for all sites.

That was actually my first thought after reading this. Chances are, people in public wifi spots will actively and aggressively ignore any and all warnings that get in the way of them getting their work done (I have witnessed this far too many times).

However, Chrome surprised me the other day by not allowing me to continue on to a site that didn't have a valid certificate (I was MiTM myself using PAROS proxy to test something). In other words, we don't need stricter warnings, but the warnings must become errors for them to be noticed.

Re: Should All Web Traffic Be Encrypted?

#133

Post by match » Sat, Feb 25, 2012, 2:55 AM UTC

marshray wrote: post #63

match wrote: post #56

Earlier quoted context omitted.

It largely depends up the nature of your web service. If you are running a user-interactive site theb i may buy it. However if you are offering a high-tps, high-throughput web service I assure you the costs of switching 100% of your users to SSL is not negligable and has a real impact on the customer experience.

I think agl is familiar with both kinds. His company tends to serve both the HTML and the APIs through the same set of load balancers.

That's a little dismissive. Perhaps we're just talking about different levels of scale.

Re: Should All Web Traffic Be Encrypted?

#134

Post by gurkendoktor » Sat, Feb 25, 2012, 2:57 PM UTC

TomGullen wrote: post #124

gurkendoktor wrote: post #109

Earlier quoted context omitted.

Wow, this took forever to click. I have never written sites that spanned several servers like that. Thanks!

It's all on one server! We use Scirra.net as a cookieless domain to serve static content from (images, css, js etc) as this speeds requests up because otherwise the cookie data for the page is sent to every resource on the same domain which can slow the page load down somewhat. 1 cookieless domain is probably fine, but I found out that for us 4 subdomains (static1, static2, static3, static4) gives best page load perf…

Right, I should have said, I have never even worked with sites that span several domains (not servers). But that is a nice trick to know.

Playing around with Construct has been on my To Do list for a long, long time; I'll take note of the serving performance when I do! :)

Re: Should All Web Traffic Be Encrypted?

#135

Post by speleding » Sat, Feb 25, 2012, 10:05 PM UTC

tghw wrote: post #70

ohashi wrote: post #51

Earlier quoted context omitted.

That is a neat trick, does it work on all browsers?

It does, although IE 7 (and possibly 6) have a bug where they will double request the resource. But, honestly, if they're on IE6 or IE7, the web isn't fast for them anyways.

The double request on IE only happens on stylesheets, all other requests (including javascript) are fine.

Re: Should All Web Traffic Be Encrypted?

#136

Post by wladimir » Mon, Feb 27, 2012, 8:50 AM UTC

harryh wrote: post #120

wladimir wrote: post #84

Earlier quoted context omitted.

When going from https to https site, referer information is usually being sent, at least with modern browsers. So if the whole web goes encrypted (yay), the issue is solved.

Really? That's....very strange. The rules for this sort of thing seem so arbitrary.

It makes a little bit of sense. When you come from a https site, you don't want to leak referrer (and thus which part of which site you were visiting) over the unencrypted internet.

Though in my eyes sending referrers always has been questionable "insecure by default" behavior, as the internal structure of one site is leaked to another. With hindsight, maybe it should have been restricted to the domain name.