Switch to HTTPS Now, For Free • Hacker News Board

Re: Switch to HTTPS Now, For Free

#51

Post by JoshTriplett » Wed, Sep 25, 2013, 9:36 PM UTC

jakobe wrote: post #15

I just recently enabled SSL on my business website. It was anything but simple. First of all, I had to get a dedicated server, because a bunch of other sites were running on the same server, and the hosting company doesn't offer additional IP addresses. Then I wanted to get an SSL certificate. I picked Comodo, because they seemed to offer the cheapest full business validation certificate, but then accidentally bought…

If you're willing to write off users of Internet Explorer on Windows XP, you don't need a dedicated IP for SSL; you can simply use Server Name Indication (SNI).

Re: Switch to HTTPS Now, For Free

#52

Post by lauriswtf » Wed, Sep 25, 2013, 9:37 PM UTC

jakobe wrote: post #15

I just recently enabled SSL on my business website. It was anything but simple. First of all, I had to get a dedicated server, because a bunch of other sites were running on the same server, and the hosting company doesn't offer additional IP addresses. Then I wanted to get an SSL certificate. I picked Comodo, because they seemed to offer the cheapest full business validation certificate, but then accidentally bought…

You could have just bought the $7 cert from getssl.me and it would take just 2 minutes at most.

Re: Switch to HTTPS Now, For Free

#53

Post by schoen » Wed, Sep 25, 2013, 9:38 PM UTC

tootie wrote: post #31

Using HTTPS everywhere doesn't really help much. It doesn't help at all if the surveillers either have your cert or access to decrypted traffic inside the firewall. Any PII being sent over the wire should most definitely be encrypted, but encrypting my access to a news site isn't really hiding anything. The requested URL still need to be unencrypted, you'd just be encrypting content that is already availble unencrypt…

The particular publicly-available information that people are interested in is privacy-sensitive. It's easiest to see this by thinking about articles on sexual, medical, and religious topics at Wikipedia (or WebMD!). Although the information is public, users don't want others on the network to know that they read it.

And on some networks, the content of news articles that we might think of as totally innocuous is considered very sensitive, and the network operator might try to block it. The most familiar example might be news about annual commemorations of 6/4. Using HTTPS provides resistance against content-based censorship because the network operator doesn't know when users are reading the specific things that they wanted to prevent them from reading.

Re: Switch to HTTPS Now, For Free

#54

Post by idupree » Wed, Sep 25, 2013, 9:41 PM UTC

konklone wrote: post #27

ewolf wrote: post #4

Are there any downsides to these free certs? Do they work in all browsers; is there anything that could be better security-wise? If not, than this is exactly what we need to establish HTTPS as the new standard.

I think the main catch here is that they're only willing to issue level 1 certs to individuals. For commercial endeavors, they make you pay money, and then they also have you send in proof of identity and stuff, and manually review your documents. I don't think there's a practical difference in security level, but I'm not an expert in this (which is why I don't address this aspect in my guide).

Unless I've misunderstood their policy, they also forbid individuals using Class 1 certificates commercially. For example, if you run a blog with "Support my blog! Buy my T-shirt swag from swag-selling-site.com[link]!" then your blog is commercial (per legal definition of commercial; IANAL); thus StartCom's policy forbids you to use their free certificate for that site.

The first sentence and a half of this paragraph[1] from https://startssl.com/policy.pdf expressly forbid it. Its final "when" clause might be trying to limit what is forbidden, but, grammatically, it has no power to restrict the first sentence, and doesn't properly restrict the second sentence either.

[1] "Class 1 certificates are limited to client and server certificates, whereas the later is restricted in its usage for non-commercial purpose only. Subscribers MUST upgrade to Class 2 or higher level for any domain and site of commercial nature, when using high-profile brands and names or if involved in obtaining or relaying sensitive information such as health records, financial details, personal information etc."

(Naturally, I hope I've misunderstood their policy.)

Re: Switch to HTTPS Now, For Free

#55

Post by ivanr » Wed, Sep 25, 2013, 9:41 PM UTC

handsomeransoms wrote: post #16

Fun fact about Startcom (providers of StartSSL): they were the only certificate authority that the "Comodohacker" responsible for breaching Comodo, Diginotar, and others, was unable to hack. [1] [1] http://www.informationweek.com/security/attacks/how-startcom...

You probably meant to say that they are the only CA Comodohacker admitted attacking and failing to obtain any fraudulent certificates. Given that there are over 100 CAs, it's likely that the same person/organisation attempted attacking others and failed.

One interesting thing about that incident is that Startcom never released a report to state exactly what had happened, which is in contrast with some other hacking incidents they suffered. If what Comodhacker said was true (that he had been able to communicate with the NSM), then they definitely were hacked -- just not critically.

Re: Switch to HTTPS Now, For Free

#56

Post by imaginator » Wed, Sep 25, 2013, 9:42 PM UTC

StartSSL offer a great service.

If you'd rather use the Java Keytool to manage your certs, I wrote up this guide on making it work with StartSSL. https://buddycloud.org/wiki/buddycloud_SSL_setup

Should just be a copy paste, wait, paste, export job.

Re: Switch to HTTPS Now, For Free

#57

Post by jakobe » Wed, Sep 25, 2013, 9:44 PM UTC

lauriswtf wrote: post #45

jakobe wrote: post #15

I just recently enabled SSL on my business website. It was anything but simple. First of all, I had to get a dedicated server, because a bunch of other sites were running on the same server, and the hosting company doesn't offer additional IP addresses. Then I wanted to get an SSL certificate. I picked Comodo, because they seemed to offer the cheapest full business validation certificate, but then accidentally bought…

You could have just bought the $7 cert from getssl.me and it would take 2 minutes at most.

They just resell Comodo certificates, so I assume I'd have the same issues with broken emails and offline managment area and emails promising "Your order is being processed right now" (the business validation stuff was only a part of the problem)

Also, it makes me angry how you have all those beautifully designed landing pages everywhere, and as soon as you have ordered, you have to deal with ugly and confusing websites that barely work at all.

Re: Switch to HTTPS Now, For Free

#58

Post by ivanr » Wed, Sep 25, 2013, 9:45 PM UTC

Zoepfli wrote: post #6

In the switch to https everywhere, we have barely started. For every HN and wikipedia with https there are 20 websites without (and whether the ones that do https do really secure https is yet another question). Somebody should go through the top 10k websites and make a list, then repeat every few months.

FYI, in my research, about 10% of Alexa top 1 million sites support SSL. For the configuration of those 10%, see SSL Pulse https://www.trustworthyinternet.org/ssl-pulse/

Re: Switch to HTTPS Now, For Free

#59

Post by espeed » Wed, Sep 25, 2013, 9:46 PM UTC

Make sure you do not use compression with SSL.

Using compression with SSL could make your site vulnerable to the CRIME and BREACH attacks. See...

SSL Gone in 30 Seconds - A BREACH Beyond CRIME [video]: http://www.youtube.com/watch?v=pIKIXQNFplY&hd=1

BREACH Attack (HTTP Compression): http://breachattack.com, http://security.stackexchange.com/questions/39925/breach-a-n...

CRIME Attack (SSL/TLS/SPDY Compression): http://en.wikipedia.org/wiki/CRIME_(security_exploit), http://security.stackexchange.com/questions/19911/crime-how-...

Re: Switch to HTTPS Now, For Free

#60

Post by vacri » Wed, Sep 25, 2013, 9:46 PM UTC

dpe82 wrote: post #25

jakobe wrote: post #15

I just recently enabled SSL on my business website. It was anything but simple. First of all, I had to get a dedicated server, because a bunch of other sites were running on the same server, and the hosting company doesn't offer additional IP addresses. Then I wanted to get an SSL certificate. I picked Comodo, because they seemed to offer the cheapest full business validation certificate, but then accidentally bought…

Someone should probably point out: most of your problems were related to doing full business validation from a crappy provider. Business validation is optional and doesn't enhance the transport-layer security benefits of using SSL.

Business validation is what you should be using for a business site. It's actually a good thing and means that the company is interested in verifying who you are.

I went through the dance with Startcom and agree with the article that the web interface has horrible workflow. However they were clearly doing their best to verify that it actually was a business they were creating an account for. For example, they ignored the phone number I gave them, and instead called on the publicly-listed phone number they found on the internet.