Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Switch to HTTPS Now, For Free

konklone.com

Post reply on HN
Print view View original

91–100 of 264 posts

Re: Switch to HTTPS Now, For Free

#91

Post by bitwizzle »

espeed wrote: post #59

Make sure you do not use compression with SSL. Using compression with SSL could make your site vulnerable to the CRIME and BREACH attacks. See... SSL Gone in 30 Seconds - A BREACH Beyond CRIME [video]: http://www.youtube.com/watch?v=pIKIXQNFplY&hd=1 BREACH Attack (HTTP Compression): http://breachattack.com , http://security.stackexchange.com/questions/39925/breach-a-n... CRIME Attack (SSL/TLS/SPDY Compression): http:…

While it's true that you should disable compression, most browsers disable it client-side now so this isn't a huge issue. As for BREACH, HTTP compression has a huge performance benefit, so it's not really feasible to disable it. Unfortunately, it's pretty difficult to protect the attack using other methods.

Re: Switch to HTTPS Now, For Free

#92

Post by __david__ »

ewolf wrote: post #4

Are there any downsides to these free certs? Do they work in all browsers; is there anything that could be better security-wise? If not, than this is exactly what we need to establish HTTPS as the new standard.

They do not work on Windows XP (unless the user is using Firefox or Chrome), as the StartCom certificate is not part of the XP trusted root certs. There is an update available from Microsoft to add some new root certs but as far as I can tell it is a manual only update, which means it's very unlikely to be installed by XP users.

We tried to switch our site to https only recently, and had to backtrack because of this (and because we are too cheap/stubborn to buy an SSL cert from someone who is in the XP trusted root certs).

Re: Switch to HTTPS Now, For Free

#93

Post by valtron »

As I understand it, (correct me if I'm wrong), https has two parts:

1. Encryption: protects from eavesdropping (e.g. your internet provider can't see what you're communicating)

2. Authentication: protects from MITM (e.g. someone changing the data en-route)

For full security you need both; but #2 is much more complicated than #1 because it needs a trusted third party, certificates, etc. It's effectively a barrier to having everyone use encryption.

Why isn't it possible to opt for only #1? It should be as simple as adding "Encrypt +All" to your apache settings.

Re: Switch to HTTPS Now, For Free

#94

Post by barrydahlberg »

espeed wrote: post #59

Make sure you do not use compression with SSL. Using compression with SSL could make your site vulnerable to the CRIME and BREACH attacks. See... SSL Gone in 30 Seconds - A BREACH Beyond CRIME [video]: http://www.youtube.com/watch?v=pIKIXQNFplY&hd=1 BREACH Attack (HTTP Compression): http://breachattack.com , http://security.stackexchange.com/questions/39925/breach-a-n... CRIME Attack (SSL/TLS/SPDY Compression): http:…

Can you please clarify exactly what you mean by compression? Is this referring to typical gzip compression in HTTP results or something else?

Re: Switch to HTTPS Now, For Free

#95

Post by mikeash »

valtron wrote: post #93

As I understand it, (correct me if I'm wrong), https has two parts: 1. Encryption: protects from eavesdropping (e.g. your internet provider can't see what you're communicating) 2. Authentication: protects from MITM (e.g. someone changing the data en-route) For full security you need both; but #2 is much more complicated than #1 because it needs a trusted third party, certificates, etc. It's effectively a barrier to h…

I believe the problem is that it's impossible to distinguish between "the remote server doesn't care about authentication" and "the remote server cares about authentication, but your traffic to it is being intercepted and modified by an eavesdropper who is retransmitting the data without the authentication flag".

You can opt for only #1, but virtually every browser will put up gigantic warnings about it because it's indistinguishable from a MITM attack.

Re: Switch to HTTPS Now, For Free

#96

Post by agwa »

cmircea wrote: post #87
agwa wrote: post #73

Earlier quoted context omitted.

Unfortunately. it's not always just the cost - too many providers (e.g. DigitalOcean) obnoxiously don't support multiple IP addresses on a server/VM.

DigitalOcean is small... Windows Azure does not support multiple IPs except for hosted websites. Cloud Services or Virtual Machines get only one IP. And dedicated IPs for websites are extremely expensive.

Further proving my point... Joyent is another example of a cloud provider which only gives you one IP address.

It doesn't need to be this way - Linode gives extra addresses for $1/month each (provided valid technical justification, such as the need to run HTTPS).

Re: Switch to HTTPS Now, For Free

#97

Post by dendory »

This is kind of glossing over the point. We all know SSL is good and should be used everywhere. But the simple fact is that to have a fully capable SSL server you need two things: A certificate and a unique IP. There are firms now offering free certificates, but not everyone has the choice to select them. And IP certainly aren't free on most hosts. Sure there are always solutions, like moving to a self hosted model and so on, but it is a significant inconvenience for most.

Re: Switch to HTTPS Now, For Free

#99

Post by dragonwriter »

valtron wrote: post #93

As I understand it, (correct me if I'm wrong), https has two parts: 1. Encryption: protects from eavesdropping (e.g. your internet provider can't see what you're communicating) 2. Authentication: protects from MITM (e.g. someone changing the data en-route) For full security you need both; but #2 is much more complicated than #1 because it needs a trusted third party, certificates, etc. It's effectively a barrier to h…

You can't have protection from eavesdropping without protection from MITM, because MITM can be used for eavesdropping (as well as actually inserting malicious traffic into the communication.)

Which is why encryption without authentication is pointless (or, worse, illusory security) in most cases. On the internet, your communication is inherently being handed off through a number of intermediaries to an endpoint. If you don't know who the endpoint is, it doesn't do you any good to know that your connection is secure from you to the endpoint.

Re: Switch to HTTPS Now, For Free

#100

Post by chc »

andrewvc wrote: post #98
chc wrote: post #36

Just going to throw out that if you use a Cloudflare business plan, you can just tick a couple of boxes and get SSL for free.

What, I thought you had to pay? Yup, it says you have to pay

You have to pay for the business plan. If you're already paying for that, the SSL is free. Unless they've changed how it works and I've just gotten grandfathered in or something.
Post reply on HN