Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS by default

security.googleblog.com

Post reply on HN
Print view View original

151–160 of 268 posts

Re: HTTPS by default

#151

Post by 1vuio0pswjnm7 »

vhcr wrote: post #21
sam_lowry_ wrote: post #12

Earlier quoted context omitted.

I run my blog in unencrypted HTTP/1.1 just to make a point that we do not have to depend on third parties to publish content online. And I noticed that Whatsapp is even worse than Chrome, it opens HTTPS even if I share HTTP links.

Depend on one less third party, you still depend on the DNS Root servers, your ISP / hosting, domain registry, etc.

Third party root servers are generally used for looking up TLD nameservers, not for looking up domainnames registered to individuals publishing personal blogs^1

Fortunately, one can publish on the www without using ICANN DNS

For example http://199.233.217.201 or https://199.233.217.201

1. I have run own root server for over 15 years

An individual cannot even mention choosing to publish a personal blog over HTTP without being subjected to a kneejerk barrage of inane blather. This is truly a sad state of affairs

I'm experimenting with non-TLS, per packet encryption with a mechanism for built-in virtual hosting (no SNI) and collision-proof "domainnames" on the home network as a reminder that TLS is not the only way to do HTTPS

It's true we depend on ISPs for internet service but that's not a reason to let an unlimited number of _additional_ third parties intermediate and surveil everything we do over the internet

Re: HTTPS by default

#152

Post by tracker1 »

01HNNWZ0MV43FF wrote: post #121
tracker1 wrote: post #95

Earlier quoted context omitted.

I don't get your logic/reasoning here... could you explain?

There are public logs of every TLS cert issued by the major providers. This benefits Google. Kinda like how Wikipedia benefits Google. Or public roads benefit Uber. Or clean water benefits restaurants

Google also knows about every domain name that gets renewed or registered... How does knowing a website has tls help in any meaningful way that would detract from society as a whole?

Re: HTTPS by default

#153

Post by Maxious »

EGreg wrote: post #143
protocolture wrote: post #125

Prediction: Wifi captive portal vendors will not react to this until after 90% of their customerbase has their funding dry up. It is incredibly common for public wifi captive portals to be built on a stack of hacks, some of which require the inspection of HTTP and DNS requests to function. *Yes better tools exist, but they dont arent commonly used, and require Portal, WAP and Client support. Most vendors just tell pe…

What are you talking about? You can easily build the captive portals by setting up a custom DNS server, and HTTPS has nothing to do with it! In fact, local networks have been doing this very thing for years now. Apple even supports Detecting this interception so the operating system can show a captive portal to the user. The OS maker gives network admins an official a way to enforce captive portals, and it’s not goin…

You can but many vendors have not yet adopted that

Re: HTTPS by default

#154

Post by superkuh »

HTTPS is great. HTTPS without HTTP is terrible for many human person use cases. Pretending those use cases don't exist is anti-human. But for corporate person use cases HTTPS-only is more than fine, it's required. So they'll force it on us all in all contexts. But in our own personal setups we can chose to be the change we want to see in the world and run HTTP+HTTPS. Even if most of the web becomes an HTTPS-only ID-centric corporate wasteland it doesn't take that many people to make a real web. It existed before them and still does. There's more human's websites out there now then ever. It's just getting harder and harder to find and see using their search and browser defaults. It's not okay, but maybe this is finally a solution to eternal september and we can all just live peacefully on TCP/IP HTTP/1.1 HTTP+HTTPS with HTML while corporate persons diverge off into UDP-land with HTTP/3 HTTPS-only CA TLS only QUIC for delivering javascript applications.

Re: HTTPS by default

#155

Post by bruce511 »

rpdillon wrote: post #124
sam_lowry_ wrote: post #34

Earlier quoted context omitted.

Let's Encrypt pushes me to run its self-updating certbot on my personal server, which is a big no-go. I know about acme.sh, but still...

I counted by hand, so it might be wrong, but they appear to list and link to 86 different ACME client implementations across more than a dozen languages: https://letsencrypt.org/docs/client-options/ I've used their stuff since it came out and never used certbot, FWIW. If I were to set something up today, I'd probably use https://github.com/dehydrated-io/dehydrated .

Plus, it's one of the easier protocols to implement. I implemented it myself, and it didn't take long.

So you're absolutely not dependent on the client software, or indeed anyone else's client software.

Re: HTTPS by default

#156

Post by bruce511 »

sam_lowry_ wrote: post #12
tialaramex wrote: post #7

I have had HTTPS-by-default for years and I can say that we're past the point where there's noticeable year-to-year change for which sites aren't HTTPS. It's almost always old stuff that pre-dates Let's Encrypt (and presumably just nobody ever added HTTPS). The news site which stopped updating in 2007, the blog somebody last posted to in 2011, that sort of thing. I think it's important to emphasise that although Tim'…

I run my blog in unencrypted HTTP/1.1 just to make a point that we do not have to depend on third parties to publish content online. And I noticed that Whatsapp is even worse than Chrome, it opens HTTPS even if I share HTTP links.

I applaud you for your principled stance. And of course this change in Chrome changes nothing wrt your ability to continue doing this.

Equally your preference for HTTP should not stand in the way of a more secure default for the average person.

Honestly I'd prefer that my mom didn't browse any http sites, it's just safer that way. But that doesn't detract from your ability to serve unencrypted pages which can easily be intercepted or modified by an ISP (or worse.)

Re: HTTPS by default

#157

Post by yardstick »

deathanatos wrote: post #8
drusepth wrote: post #3

Doesn't it already do this? I keep a domain or two on HTTP to force network-level auth flows (which don't always fire correctly when hitting HTTPS) and I've gotten warnings from Chrome about those sites every time for years... Only if I've been to the site recently does the warning not show up.

Right now it only shows a little bubble in the URL bar saying "Not Secure", I think. (So, that is a "warning", in a sense.) TFA is saying there will now be an interstitial if you attempt an HTTP connection. HSTS might also interact with this, but I'd expect an HSTS site to just cause Chrome to go for HTTPS (and then that connection would either succeed or fail). > to force network-level auth flows (which don't always…

I don’t believe Android IPv6 stack supports dhcp, so won’t be much use there.

Re: HTTPS by default

#158

Post by yardstick »

danpalmer wrote: post #140
ottah wrote: post #91

Mmmm, great that and mandatory key rotation every 90 days, plus needing to get a cert from an approved CA, means just that more busy work to have an independent web presence. I don't like people externalizing their security policy preferences. Yes this might be more secure for a class of use-cases, but I as a user should be allowed to decide my threat model. It's not like these initiatives really solve the risks pose…

HTTPS doesn't have mandatory key rotation every 90 days. LetsEncrypt does for reasons that they document, but you can go elsewhere if you'd prefer. > I as a user should be allowed to decide my threat model Asking you if you want to proceed is allowing you to decide your threat model. > We have so much compliance theater around email, and we still have exactly the same threats and issues as existed twenty years ago. .…

> HTTPS doesn't have mandatory key rotation every 90 days. LetsEncrypt does for reasons that they document, but you can go elsewhere if you'd prefer.

A lot of this discussion is about how the browsers define their security requirements on top of HTTPS/TLS/etc.

Such as what CAs they trust by default, and what’s the maximum lifetime of a certificate before they won’t trust it. I believe it is now 2 years? Going even lower soon.

Re: HTTPS by default

#159

Post by [deleted] »

bo1024 wrote: post #115

> What's worse, many plaintext HTTP connections today are entirely invisible to users, as HTTP sites may immediately redirect to HTTPS sites. That gives users no opportunity to see Chrome's "Not Secure" URL bar warnings after the risk has occurred, and no opportunity to keep themselves safe in the first place. What is the risk exactly? A man-in-the-middle redirect to a malicious https site?

[deleted]

Re: HTTPS by default

#160

Post by JakaJancar »

1vuio0pswjnm7 wrote: post #151
vhcr wrote: post #21

Earlier quoted context omitted.

Depend on one less third party, you still depend on the DNS Root servers, your ISP / hosting, domain registry, etc.

Third party root servers are generally used for looking up TLD nameservers, not for looking up domainnames registered to individuals publishing personal blogs^1 Fortunately, one can publish on the www without using ICANN DNS For example http://199.233.217.201 or https://199.233.217.201 1. I have run own root server for over 15 years An individual cannot even mention choosing to publish a personal blog over HTTP witho…

You have some weird definition of "root".
Post reply on HN