Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bing doesn't support SSL

bing.com

Post reply on HN
Print view View original

81–90 of 163 posts

Re: Bing doesn't support SSL

#81

Post by T-hawk »

freehunter wrote: post #71
casca wrote: post #2

TL;DR: bing SSL certificate is wrong. https://bing.com : subject=/CN=*.bing.com https://www.bing.com : subject=/C=US/O=Akamai Technologies, Inc./CN=a248.e.akamai.net

Working in information security, I see this far, far too often in support tickets from employees who are unable to get to a site because our proxy is blocking misconfigured certificates. Usually we like to reach out to the owner of the site and have them update their configuration, and it gets quite frustrating when we find an unresponsive organization. Having to bypass cert checking for a site on our end is a huge s…

> There's no reason to send a page to your users over HTTPS if they can't trust the certificate.

There can be. HTTPS still gives you encryption over the wire. It still protects against a passive eavesdropper, like a casual packet sniffer on a public wi-fi network. The whole certificate deal protects against a Mallory with power to intercept and spoof messages. Of course nobody on the public internet can be sure there isn't a Mallory in or at the edge of the user's ISP, but in plenty of intranet or otherwise controlled networking scenarios, HTTPS with certificates lacking a trust chain can be reasonable.

Re: Bing doesn't support SSL

#82

Post by wallunit »

NelsonMinar wrote: post #77

Bing is important. It's a good search engine, comparable to Google's quality and size. And it's the only competition Google has in the US and most of Europe. (Sites like DuckDuckGo and Yahoo pass queries on to Bing). Dumb errors like this SSL problem are embarassing, but the larger frustration is how despite years of having a good product, they have so little market traction.

Its so impressing how Bing manages to deliver search results as well curated as those from Google. But wait, I just remembered that is because of they rely on search results from Google. ;P

http://googleblog.blogspot.de/2011/02/microsofts-bing-uses-g...

Re: Bing doesn't support SSL

#83

Post by bcoates »

deepblueocean wrote: post #31

Wow. This has been going on for an hour now. It's such a simple fix, especially since one would assume that they already have a valid cert somewhere (or that Akamai does). Yet they've had an hour of SSL downtime. Does anyone know if Bing has any SSL-only clients? Like do any of their toolbars or built-in search widgets in Windows use SSL by default?

I think it's always been like this. Bing has never run over https as far as I can tell.

Re: Bing doesn't support SSL

#84

Post by ccarter84 »

sdfjkl wrote: post #64
mekoka wrote: post #54

The real question is, is bing.com even supposed to be served over https?

With very few exceptions, everything is supposed to be served over HTTPS (or other secure protocols). Certainly something as sensitive as search traffic. Tell me your search queries and I'll tell you your interests, health problems, relationships, if you're happy in your job and what kind of porn you like.

That last one is where they get ya

Re: Bing doesn't support SSL

#88

Post by theoutlander »

mdmarra wrote: post #30
ganarajpr wrote: post #15

Earlier quoted context omitted.

To Microsoft : Please fix your IE debacle ( somehow!!).. Its affecting your other products.. Its reputation is becoming infectious.

What IE debacle? Trident is now widely considered to have the most correct HTML5 implementation in a major browser. It might not have all of the draft stuff that Webkit has, but it also doesn't require all of the webkit css hacks.

Well, it can certainly do a lot better ... check out caniuse.com for more details.

Re: Bing doesn't support SSL

#89

Post by ajross »

T-hawk wrote: post #81
freehunter wrote: post #71

Earlier quoted context omitted.

Working in information security, I see this far, far too often in support tickets from employees who are unable to get to a site because our proxy is blocking misconfigured certificates. Usually we like to reach out to the owner of the site and have them update their configuration, and it gets quite frustrating when we find an unresponsive organization. Having to bypass cert checking for a site on our end is a huge s…

> There's no reason to send a page to your users over HTTPS if they can't trust the certificate. There can be. HTTPS still gives you encryption over the wire. It still protects against a passive eavesdropper, like a casual packet sniffer on a public wi-fi network. The whole certificate deal protects against a Mallory with power to intercept and spoof messages. Of course nobody on the public internet can be sure there…

Right. MitM attacks and variants are a proper subset of the mischief that can be achieved with an unsecured connection. Among other things, it's routine that people (hi!) use self-signed certs for personal or temporary TLS sites. I'd be very annoyed to pass a basic-auth-protected https git url to someone for quick-and-mostly-secure read-only access and have their access be denied by a local proxy...

Re: Bing doesn't support SSL

#90

Post by sixothree »

NelsonMinar wrote: post #77

Bing is important. It's a good search engine, comparable to Google's quality and size. And it's the only competition Google has in the US and most of Europe. (Sites like DuckDuckGo and Yahoo pass queries on to Bing). Dumb errors like this SSL problem are embarassing, but the larger frustration is how despite years of having a good product, they have so little market traction.

I think it's as simple as having chosen an awful name. Bing is physically difficult to pronounce and it evokes no meaning whatsoever.
Post reply on HN