81–90 of 264 posts
I see a potential vuln here for free e-mail services. If one manages to register one of those addresses he can create a trusted certificate and use it for MITM.
If browsers got fixed to not freak out on self-signed certificates, this wouldn't even be an issue, HTTPS could be a default.
Earlier quoted context omitted.
If you're willing to write off users of Internet Explorer on Windows XP, you don't need a dedicated IP for SSL; you can simply use Server Name Indication (SNI).
But then I'd need to support SSL for all domains hosted on the server, and this would mean getting 5 certificates instead of one.
> As you can see, StartSSL will believe you own the domain if you control webmaster@, postmaster@, or hostmaster@ with the domain name I see a potential vuln here for free e-mail services. If one manages to register one of those addresses he can create a trusted certificate and use it for MITM.
It also highlights a critical SSL issue; there's really little strength in the concept of a certificate proving the identity of anyone.
Earlier quoted context omitted.
I appreciate your detailed response! I should not have been so dismissive of those users. Still, I maintain that the "extra cost for a dedicated IP" is a poor excuse for not implementing SSL.
Unfortunately. it's not always just the cost - too many providers (e.g. DigitalOcean) obnoxiously don't support multiple IP addresses on a server/VM.
Earlier quoted context omitted.
I appreciate your detailed response! I should not have been so dismissive of those users. Still, I maintain that the "extra cost for a dedicated IP" is a poor excuse for not implementing SSL.
Unfortunately. it's not always just the cost - too many providers (e.g. DigitalOcean) obnoxiously don't support multiple IP addresses on a server/VM.
And dedicated IPs for websites are extremely expensive.
Earlier quoted context omitted.
I would be willing to bet over 95% of SSL-secured sites don't have business validation certificates. Given virtually nobody visiting your site will know what that means, let alone how to check anything about the certificate you're using, it just doesn't make sense to pay extra for no benefit. A domain-validated certificate costs less while providing the same padlock icon and level of encryption, and takes just minute…
In my case, I don't care about encryption. On my website, I only offer software for download. No private data. Payment is handled by a third party. The only reason why I want to support https is so that customers can confirm who they are downloading from. Ideally, I'd like an EV certificate, but I can't afford that. So I chose a business validation cert. A domain only certificate wouldn't really confirm anything. (Al…
It's interesting, I did switch to HTTPS for all my sites but Google Search still did not reveal search keywords to Google Analytics from users logged in at Google. If that's what was referred as "referrer information".
Did anyone get lucky with getting 100% of google search keywords after switching to SSL?
Make sure you do not use compression with SSL. Using compression with SSL could make your site vulnerable to the CRIME and BREACH attacks. See... SSL Gone in 30 Seconds - A BREACH Beyond CRIME [video]: http://www.youtube.com/watch?v=pIKIXQNFplY&hd=1 BREACH Attack (HTTP Compression): http://breachattack.com , http://security.stackexchange.com/questions/39925/breach-a-n... CRIME Attack (SSL/TLS/SPDY Compression): http:…
SSL Labs does a great job of SSL testing domains and making recommendations: https://www.ssllabs.com/ssltest/analyze.html?d=konklone.com I developed my nginx config based on their recommendations: https://gist.github.com/konklone/6532544
In his 2010 talk "Everything you need to know about cryptography in 1 hour" (http://blip.tv/fosslc/everything-you-need-to-know-about-cryp...), Colin also recommends limiting SSL use to a confined area.
Amazon does this.
For example, Amazon.com only uses only SSL when you log in, check out, or access "Your Account". Everywhere else Amazon.com uses HMAC request signatures over HTTP, similar to how AWS API requests are signed.
See "Signing AWS API Requests" (http://docs.aws.amazon.com/general/latest/gr/signing_aws_api...)
To Colin and the other security professionals on HN:
* Is limiting SSL still recommended in spite of the trend toward Always-On-SSL?
* What are the current best practices and tradeoff considerations of this approach?