Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to implement HTTPS in an insufficient manner

troyhunt.com

Post reply on HN
Print view View original

41–50 of 68 posts

Re: How to implement HTTPS in an insufficient manner

#41

Post by nageeb »

markhemmings wrote: post #8

I'm the guy who originally contacted Troy Hunt about this, as he mentions in the blog post. What annoys me is I'm a very young developer, and I've only really just become interested in security (12 months ago I didn't even know what hashing was!!!), yet there's developers out there with years and years of experience making huge sites for the likes of Tesco and TopCashBack for vast sums of money and they don't think a…

"Years and years experience"

This is not always the case. Lots of marketing/PR companies started off in the pre-Internet days, and simply added websites to their list of services and rely solely on the experience of their devs to handle the rest. I was a contractor for such a company and to cut costs (read: to save on paying me), they hired a junior developer with no formal education, who specialized in copy-paste programming to do many of their large sites. He's since left, but the damage he's done still lives on in the countless sites he built for their clients, which are full of horribly insecure code (especially #1 on the HTTPS no-no list).

The good news is that, following his departure, I got plenty of work doing clean-up jobs on all the sites he built. :)

Re: How to implement HTTPS in an insufficient manner

#42

Post by trust-me »

nodata wrote: post #40
kijin wrote: post #15

The author lists 5 problems, but all of them have to do with the fact that the website in question is not 100% HTTPS. So it's really just one problem that has many different implications. When you maintain both an HTTP site and an HTTPS site, it's nearly impossible to toss state back and forth between them without exposing yourself to at least one of these problems. Even if you do everything perfectly, people will co…

No, please don't do this: If a visitor goes to http://domain/some/url they should not redirect to https://domain/some/url - it makes it harder to catch pages that use the wrong protocol. Better to redirect http://domain/some/url to https://domain Edit: if you're logging referrers from your own domain with non https:// urls AND using secure cookies, ignore my comment!

Nooo, don't erase the address that took me 5 minutes to type. What you say doesn't make any sense. You should obviously configure the https redirect as a site wide setting and not per page.

Re: How to implement HTTPS in an insufficient manner

#43

Post by EvilTerran »

nodata wrote: post #40
kijin wrote: post #15

The author lists 5 problems, but all of them have to do with the fact that the website in question is not 100% HTTPS. So it's really just one problem that has many different implications. When you maintain both an HTTP site and an HTTPS site, it's nearly impossible to toss state back and forth between them without exposing yourself to at least one of these problems. Even if you do everything perfectly, people will co…

No, please don't do this: If a visitor goes to http://domain/some/url they should not redirect to https://domain/some/url - it makes it harder to catch pages that use the wrong protocol. Better to redirect http://domain/some/url to https://domain Edit: if you're logging referrers from your own domain with non https:// urls AND using secure cookies, ignore my comment!

That would make for terrible UX, and I'd expect most users to just shrug it off as your website being weird, so it wouldn't even help you "catch pages that use the wrong protocol".

Why not just do the redirect that you know is right, but log it (with referer, so you know what needs fixed)?

Re: How to implement HTTPS in an insufficient manner

#44

Post by trust-me »

shawabawa3 wrote: post #28
claudius wrote: post #11

Earlier quoted context omitted.

Could someone explain to me why storing un(salted/hashed) passwords is such a big thing? Sure, it doesn’t hurt to salt and hash passwords[0], but since users aren’t supposed to reuse passwords anyways, what's the problem in storing 7UgHxJYjkgWDyCa9gsrH rather than db5670ac4a274055e3f785300bec563c48306bf3ab8cb32223a4cd311984a3b4? [0] And possibly normalise their length/character set, something that comes for free with…

Another point: If someone has read-only access to the database (e.g. a junior developer) they can do absolutely nothing with a hashed password

Really? Absolutely nothing! Except social engineering would be extremely easy with all that data about a user.

Re: How to implement HTTPS in an insufficient manner

#45

Post by reeses »

lucb1e wrote: post #10

Https article served over http. Lovely. Edit: Besides that problem #1 is offtopic since it has nothing to do with https and that 3/4 other points are captain obvious, #4 is actually a good one. It's so obscure that many will forget to enable it ("all pages are secured anyway"), but whenever a user visits any http page, an attacker can inject a small frame loading the http version of my website, and even if I redirect…

I almost didn't read past the introduction, where he claimed a secure form in an unsecured page meant that the contents of the submitted form would be transmitted in the clear.

Re: How to implement HTTPS in an insufficient manner

#46

Post by dmm »

JennyZ wrote: post #5
dragcdxfbv wrote: post #3

Do i have to pay or create accounts on third party services to use HTTPS (in nginx)? I never used https on my sites because there are some giant warnings ("dangerous") in browser when you go to a website that is self-signed. No warnings on plain http.

You can get a free SSL certificate at https://www.startssl.com/ , so that should not be a reason to keep you from using it. I do agree that the extreme mistrust of browsers towards self-signed certificates is an odd thing.

Browsers mistrust self-signed certificates because that's what a MITM attack would look like.

Re: How to implement HTTPS in an insufficient manner

#47

Post by newman314 »

nwh wrote: post #39
lucb1e wrote: post #10

Https article served over http. Lovely. Edit: Besides that problem #1 is offtopic since it has nothing to do with https and that 3/4 other points are captain obvious, #4 is actually a good one. It's so obscure that many will forget to enable it ("all pages are secured anyway"), but whenever a user visits any http page, an attacker can inject a small frame loading the http version of my website, and even if I redirect…

If every blog on the internet had a static IP to serve HTTPS over, we'd have even less IP addresses available than we do now.

IPv6 or SNI

Re: How to implement HTTPS in an insufficient manner

#48

Post by jackalope »

markhemmings wrote: post #8

I'm the guy who originally contacted Troy Hunt about this, as he mentions in the blog post. What annoys me is I'm a very young developer, and I've only really just become interested in security (12 months ago I didn't even know what hashing was!!!), yet there's developers out there with years and years of experience making huge sites for the likes of Tesco and TopCashBack for vast sums of money and they don't think a…

I could cite multiple reasons, but the main one I see is that the people who pay for and specify the requirements of a project are often nontechnical and don't delegate any decision making authority to technical personnel, no matter how much talent is in the pool. Repeated attempts to bring up issues are met with blank stares, as if a foreign language is being used (and to nontechnical people, it is). I've gotten calls at 5 PM on a Friday that "Our new site (hosted on a third party server) is going live on Monday! We need a domain and an SSL certificate." In a corporate or institutional environment, bureaucratic obstacles can make such a request impossible. Throw in a VIP who won't budge, and you're about to ruin the weekend for multiple employees who will remain gun-shy about disclosing any problems in the future.

Re: How to implement HTTPS in an insufficient manner

#49

Post by iaw »

troyhunt wrote: post #24
markhemmings wrote: post #8

I'm the guy who originally contacted Troy Hunt about this, as he mentions in the blog post. What annoys me is I'm a very young developer, and I've only really just become interested in security (12 months ago I didn't even know what hashing was!!!), yet there's developers out there with years and years of experience making huge sites for the likes of Tesco and TopCashBack for vast sums of money and they don't think a…

Years and years of experience? Often not, and that's speaking from years and years of experience! Vast sums of money? Yes, at least the outsourcing vendors who churn this sort of thing out. Unfortunately you're the exception Mark so good on you for that. Well I mean unfortunate for the greater web using population, but very fortunate for you!

I'm scared to death of making a more-subtle security mistake that can be exploited. I find it surprising that people can be so negligent.

Re: How to implement HTTPS in an insufficient manner

#50

Post by tquai »

markhemmings wrote: post #8

I'm the guy who originally contacted Troy Hunt about this, as he mentions in the blog post. What annoys me is I'm a very young developer, and I've only really just become interested in security (12 months ago I didn't even know what hashing was!!!), yet there's developers out there with years and years of experience making huge sites for the likes of Tesco and TopCashBack for vast sums of money and they don't think a…

How is this possible?!

In any sufficiently large organization, the people who make the decisions and the people who enact those decisions are separated by distance, background, experience, or other reasons. This is why you see so much dysfunction in large organizations, and it extends to politics and other things that affect you as well. Look for it and you'll start seeing it everywhere.

Post reply on HN