Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Over a month later and Comcast still doesn't know how to SSL

forums.comcast.com

Post reply on HN
Print view View original

41–50 of 52 posts

Re: Over a month later and Comcast still doesn't know how to SSL

#41

Post by dkrich »

chris_j wrote: post #37
runn1ng wrote: post #23

Earlier quoted context omitted.

99% of users say "stop bugging me, computer, I just want my site" and click on "ignore warning".

One problem with this is that it trains the user to ignore a security warning which might not be crying wolf next time.

Dude if somebody wants to create a man in the middle attack to see my Comcast contract, that's cool. Hell, just email me and I'll send you a copy. I think context matters. I don't think most people would ignore a cert warning if they were about to do something they deemed private.

Re: Over a month later and Comcast still doesn't know how to SSL

#42

Post by DanBC »

DavidWoof wrote: post #32

It's pretty funny that an ISP can't get their certs together, but geez, temporarily accept the cert, read the service agreement and get on with your life. Are you seriously worried about a man-in-the-middle attack here? Trying to impress first tier forum support with your long history with computers isn't helpful to anyone, and sounding off about a serious legal issue in bold and italics is probably just making the l…

> but geez, temporarily accept the cert,

That might be acceptable advice on HN, but it's lousy advice for the general public.

Re: Over a month later and Comcast still doesn't know how to SSL

#43

Post by Dylan16807 »

DanBC wrote: post #42
DavidWoof wrote: post #32

It's pretty funny that an ISP can't get their certs together, but geez, temporarily accept the cert, read the service agreement and get on with your life. Are you seriously worried about a man-in-the-middle attack here? Trying to impress first tier forum support with your long history with computers isn't helpful to anyone, and sounding off about a serious legal issue in bold and italics is probably just making the l…

> but geez, temporarily accept the cert, That might be acceptable advice on HN, but it's lousy advice for the general public.

For some types of certificate errors, sure. But we're talking about expiration here. You can still check that the certificate was validly issued and (theoretically) that it hasn't been revoked. The certificate is only a year and a half old, compared to the verisign certificate with a 10 year life span that signed it.

Re: Over a month later and Comcast still doesn't know how to SSL

#44

Post by notatoad »

TazeTSchnitzel wrote: post #33

A little OT, but using HTTPS Everywhere has shown me how badly SSL is configured on many sites. Default certs for root domain being used on subdomains, scripts and styles loaded over HTTP (and hence blocked by Chrome - by far the most common and most annoying), HTTPS port listened on but no site served, default certs for completely unrelated sites showing up, etc.

Easy solution: stop using HTTPS Everywhere to force HTTPS in cases where the admins aren't supporting it. The admins haven't configured it badly, they've configured it for the cases they want to support. Using an extension to force non-standard behaviour breaks things.

Re: Over a month later and Comcast still doesn't know how to SSL

#45

Post by [deleted] »

uiri wrote: post #15

I know the warnings are in place for a reason, but why don't the affected people just bypass the warning. There is no reason to think that just because the date changed that Comcast's certificate is now compromised. If the certificate was issued with an expiry date of five years or more, I'd understand not taking the chance; especially considering how long Comcast is taking to review their certificate - if their cert…

[deleted]

Re: Over a month later and Comcast still doesn't know how to SSL

#46

Post by [deleted] »

DavidWoof wrote: post #32

It's pretty funny that an ISP can't get their certs together, but geez, temporarily accept the cert, read the service agreement and get on with your life. Are you seriously worried about a man-in-the-middle attack here? Trying to impress first tier forum support with your long history with computers isn't helpful to anyone, and sounding off about a serious legal issue in bold and italics is probably just making the l…

[deleted]

Re: Over a month later and Comcast still doesn't know how to SSL

#48

Post by Flimm »

dkrich wrote: post #41
chris_j wrote: post #37

Earlier quoted context omitted.

One problem with this is that it trains the user to ignore a security warning which might not be crying wolf next time.

Dude if somebody wants to create a man in the middle attack to see my Comcast contract, that's cool. Hell, just email me and I'll send you a copy. I think context matters. I don't think most people would ignore a cert warning if they were about to do something they deemed private.

I doubt it. Steve Gibson once related how he sold many copies of his software on his website, even when the website accidentally had an invalid certificate. His software is geared towards a tech-savvy audience. If tech-savvy people don't behave securely, why should we expect most people to?

Re: Over a month later and Comcast still doesn't know how to SSL

#49

Post by notyourwork »

blindfly wrote: post #29

To be fair to Comcast you're running into a few things. In a non-technical kind of way and in no order... Comcast.com is (stop laughing) a high value domain. You're not likely to get any CA to just hand over a certificate in 2 seconds. It will get flagged for manual inspection and further details will be required. Large companies like this aren't as simple to handle. If it were a small startup with 3 people you want…

After a few years at Ohio State, I disagree with giving Comcast the benefit of the doubt and chalking this up to red tape.

Re: Over a month later and Comcast still doesn't know how to SSL

#50

Post by TazeTSchnitzel »

notatoad wrote: post #44
TazeTSchnitzel wrote: post #33

A little OT, but using HTTPS Everywhere has shown me how badly SSL is configured on many sites. Default certs for root domain being used on subdomains, scripts and styles loaded over HTTP (and hence blocked by Chrome - by far the most common and most annoying), HTTPS port listened on but no site served, default certs for completely unrelated sites showing up, etc.

Easy solution: stop using HTTPS Everywhere to force HTTPS in cases where the admins aren't supporting it. The admins haven't configured it badly, they've configured it for the cases they want to support. Using an extension to force non-standard behaviour breaks things.

"Force non-standard behaviour"?

If I connect using a protocol to a site, it should work! If said protocol is poorly configured, it shouldn't be available!

Post reply on HN