Switch to HTTPS Now, For Free • Hacker News Board

Re: Switch to HTTPS Now, For Free

#111

Post by konklone » Wed, Sep 25, 2013, 11:27 PM UTC

greyfade wrote: post #79

huhtenberg wrote: post #39

Oh, the sweet irony - > SSL’s not perfect, but we need to make surveillance as expensive as possible immediately followed by - > And hey, bonus: more complete referrer information in Google Analytics Make up your mind already. Are you against the surveillance or for it? You can't really sit with one ass on two chairs. -- (edit) Point being is that if you are pulling the anti-surveillance card, then you shouldn't real…

I think the idea is to make MitM snooping more difficult, not necessarily data collection by a third-party. I agree, though, it is kind of silly, knowing that Google has been complying with large numbers of FISA requests.

Google Analytics data is anonymized and aggregated - it's very different than request patterns and sessions tied to a specific IP.

Re: Switch to HTTPS Now, For Free

#112

Post by espeed » Wed, Sep 25, 2013, 11:28 PM UTC

chc wrote: post #101

espeed wrote: post #90

Earlier quoted context omitted.

Instead of using nginx or a Web server for SSL, you might consider using something like stunnel for SSL termination as recommended by 'cperciva: "...for security reasons, I prefer to keep SSL termination separate from HTTP serving" ( http://colin.percival.usesthis.com , http://www.daemonology.net/blog/2009-09-28-securing-https.ht... ). In his 2010 talk "Everything you need to know about cryptography in 1 hour" ( http…

> In his 2010 talk "Everything you need to know about cryptography in 1 hour" ( http://blip.tv/fosslc/everything-you-need-to-know-about-cryp... ), Colin also recommends limiting SSL use to a confined area. Doesn't this leave you vulnerable to session theft?

The session ID is encoded into each URL or Form, and the request is signed using an HMAC-SHA-256 signature.

Re: Switch to HTTPS Now, For Free

#113

Post by cenhyperion » Wed, Sep 25, 2013, 11:29 PM UTC

barrydahlberg wrote: post #94

espeed wrote: post #59

Make sure you do not use compression with SSL. Using compression with SSL could make your site vulnerable to the CRIME and BREACH attacks. See... SSL Gone in 30 Seconds - A BREACH Beyond CRIME [video]: http://www.youtube.com/watch?v=pIKIXQNFplY&hd=1 BREACH Attack (HTTP Compression): http://breachattack.com , http://security.stackexchange.com/questions/39925/breach-a-n... CRIME Attack (SSL/TLS/SPDY Compression): http:…

Can you please clarify exactly what you mean by compression? Is this referring to typical gzip compression in HTTP results or something else?

>Is this referring to typical gzip compression in HTTP

Yes. It's a major vulnerability discovered in the past few months that significantly weakens the crypto.

Website Describing the attack: http://breachattack.com/

Django Blog Post: https://www.djangoproject.com/weblog/2013/aug/06/breach-and-...

Re: Switch to HTTPS Now, For Free

#114

Post by tedunangst » Wed, Sep 25, 2013, 11:30 PM UTC

chc wrote: post #101

espeed wrote: post #90

Earlier quoted context omitted.

Instead of using nginx or a Web server for SSL, you might consider using something like stunnel for SSL termination as recommended by 'cperciva: "...for security reasons, I prefer to keep SSL termination separate from HTTP serving" ( http://colin.percival.usesthis.com , http://www.daemonology.net/blog/2009-09-28-securing-https.ht... ). In his 2010 talk "Everything you need to know about cryptography in 1 hour" ( http…

> In his 2010 talk "Everything you need to know about cryptography in 1 hour" ( http://blip.tv/fosslc/everything-you-need-to-know-about-cryp... ), Colin also recommends limiting SSL use to a confined area. Doesn't this leave you vulnerable to session theft?

Yes and no. Depends on what you let open sessions do. For example, you can steal my Amazon cookies and dick with my wish list, or put a bunch of crap in my cart, or fill my recommendation list with weird stuff. But you can't buy anything because Amazon asks again for my password. (There does seem to be an option now to skip that, but I've never enabled it. Lets pretend I'm talking about the old Amazon.)

Re: Switch to HTTPS Now, For Free

#115

Post by icebraining » Wed, Sep 25, 2013, 11:32 PM UTC

nilved wrote: post #32

This isn't strictly related to this post, but I've always thought that the idea of paying a fee for SSL certificates was a bad one. Time spent buying and setting up an SSL certificate would be better spent making your site available as a Tor hidden service.

I'd rather disconnect my web server, it'd take less effort and receive the same number of visitants.

Re: Switch to HTTPS Now, For Free

#116

Post by jackalope » Wed, Sep 25, 2013, 11:33 PM UTC

dendory wrote: post #97

This is kind of glossing over the point. We all know SSL is good and should be used everywhere. But the simple fact is that to have a fully capable SSL server you need two things: A certificate and a unique IP. There are firms now offering free certificates, but not everyone has the choice to select them. And IP certainly aren't free on most hosts. Sure there are always solutions, like moving to a self hosted model a…

SSL/TLS is entirely a server/client exchange that has absolutely nothing to do with IP addresses. If you get the wrong certificate, you have either a crappy client, a crappy server, a misconfigured client, or a misconfigured server. For each case, there is a workaround, and that is where the inconvenience lies.

Re: Switch to HTTPS Now, For Free

#117

Post by powertower » Wed, Sep 25, 2013, 11:35 PM UTC

vacri wrote: post #60

dpe82 wrote: post #25

Earlier quoted context omitted.

Someone should probably point out: most of your problems were related to doing full business validation from a crappy provider. Business validation is optional and doesn't enhance the transport-layer security benefits of using SSL.

Business validation is what you should be using for a business site. It's actually a good thing and means that the company is interested in verifying who you are. I went through the dance with Startcom and agree with the article that the web interface has horrible workflow. However they were clearly doing their best to verify that it actually was a business they were creating an account for. For example, they ignored…

Except not even 99.9995% of your customers will know or care about the level of your SSL Cert.

It really does not add anything to the equation. Just extra costs and work for you.

It's been studied and pointed out that a green-bar does nothing to conversions and sales.

I suggest skipping it always, but often times a higher business type will override the suggestion of whomever has to implement it and maintain it - simply because they really don't get it or don't care about the cost (which isn't really that much, but still, you have to jump through hoops getting the docs in order).

Re: Switch to HTTPS Now, For Free

#118

Post by zobzu » Wed, Sep 25, 2013, 11:41 PM UTC

zobzu wrote: post #106

zmmmmm wrote: post #102

Do people trust StartCom? Just curious ... I always wondered why you have all these very expensive cert providers who charge a lot for SSL certs, and then this mysterious company with ties to Israel is handing them out for free? I know it's pure paranoia, but this would seem to be an excellent way to compromise a lot of SSL traffic if you were into that, and the Israelis are pretty famous for all kinds of spying acti…

making certs doesn't take money. verifying you own the domain (lowest level cert) doesnt take money. all this is fully automated, everywhere. Being an SSL provider is a juicy business once you get things rolling. Now then again, it dosn't matter if you trust them or not, because your browser trust them for you. using another provider will not make you have a better trust in the sites you browse. Any of the providers…

(note: in chrome this is not 100% true, some certs are pinned by having their trust hardcoded. its a very small list, require browser update, and of course, you're still trusting a large CA anyway)

Re: Switch to HTTPS Now, For Free

#119

Post by espeed » Wed, Sep 25, 2013, 11:42 PM UTC

barrydahlberg wrote: post #94

espeed wrote: post #59

Make sure you do not use compression with SSL. Using compression with SSL could make your site vulnerable to the CRIME and BREACH attacks. See... SSL Gone in 30 Seconds - A BREACH Beyond CRIME [video]: http://www.youtube.com/watch?v=pIKIXQNFplY&hd=1 BREACH Attack (HTTP Compression): http://breachattack.com , http://security.stackexchange.com/questions/39925/breach-a-n... CRIME Attack (SSL/TLS/SPDY Compression): http:…

Can you please clarify exactly what you mean by compression? Is this referring to typical gzip compression in HTTP results or something else?

Yes, BREACH exploits HTTP body compression so this means typical gzip compression in HTTP results (see http://breachattack.com, http://en.wikipedia.org/wiki/HTTP_compression#Security_impli...).

Full Paper: "BREACH: Reviving the CRIME Attack" (http://breachattack.com/resources/BREACH%20-%20SSL,%20gone%2...)

Re: Switch to HTTPS Now, For Free

#120

Post by tedunangst » Wed, Sep 25, 2013, 11:43 PM UTC

dragonwriter wrote: post #99

valtron wrote: post #93

As I understand it, (correct me if I'm wrong), https has two parts: 1. Encryption: protects from eavesdropping (e.g. your internet provider can't see what you're communicating) 2. Authentication: protects from MITM (e.g. someone changing the data en-route) For full security you need both; but #2 is much more complicated than #1 because it needs a trusted third party, certificates, etc. It's effectively a barrier to h…

You can't have protection from eavesdropping without protection from MITM, because MITM can be used for eavesdropping (as well as actually inserting malicious traffic into the communication.) Which is why encryption without authentication is pointless (or, worse, illusory security) in most cases. On the internet, your communication is inherently being handed off through a number of intermediaries to an endpoint. If y…

I agree and disagree. Not all adversaries have active intercept capabilities. Some are just passive. Defending against them isn't entirely pointless.

I really, really dislike the CA cabal. Self signed "encrypt only" certs combined with auto cert pinning in browsers would probably solve 99% of the problem.