121–130 of 264 posts
Are there any downsides to these free certs? Do they work in all browsers; is there anything that could be better security-wise? If not, than this is exactly what we need to establish HTTPS as the new standard.
Those aren't horrible trade offs tho, but yes, those are limitations.
Earlier quoted context omitted.
SSL Labs does a great job of SSL testing domains and making recommendations: https://www.ssllabs.com/ssltest/analyze.html?d=konklone.com I developed my nginx config based on their recommendations: https://gist.github.com/konklone/6532544
We just scored F: https://www.ssllabs.com/ssltest/analyze.html?d=scirra.com But I'm not quite sure what I need to do to make it better?
the big one is you need to remove the following cyphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5 (0x700c0) SSL_CK_RC4_128_WITH_MD5 (0x10080)
and disable sslv2
Earlier quoted context omitted.
I think the idea is to make MitM snooping more difficult, not necessarily data collection by a third-party. I agree, though, it is kind of silly, knowing that Google has been complying with large numbers of FISA requests.
Google Analytics data is anonymized and aggregated - it's very different than request patterns and sessions tied to a specific IP.
Do people trust StartCom? Just curious ... I always wondered why you have all these very expensive cert providers who charge a lot for SSL certs, and then this mysterious company with ties to Israel is handing them out for free? I know it's pure paranoia, but this would seem to be an excellent way to compromise a lot of SSL traffic if you were into that, and the Israelis are pretty famous for all kinds of spying acti…
And how do they guarantee identity for zero cost to them? To actually meet all the CA requirements to be a default trusted root isn't easy.
There are higher levels of validation - "business validation" usually involves faxing someone copies of various government supplied paperwork and receiving phone calls on publicly available phone numbers (which is just "outsourcing the identity guarantee" to yellow pages or Dun and Bradstreet.) "EV" validation ( for "green address bar as well as padlock icon" security requires all that plus spending lots of money.
Earlier quoted context omitted.
Unfortunately. it's not always just the cost - too many providers (e.g. DigitalOcean) obnoxiously don't support multiple IP addresses on a server/VM.
Why's this a problem related to SSL?
Read https://en.wikipedia.org/wiki/Server_Name_Indication for more info.
This is kind of glossing over the point. We all know SSL is good and should be used everywhere. But the simple fact is that to have a fully capable SSL server you need two things: A certificate and a unique IP. There are firms now offering free certificates, but not everyone has the choice to select them. And IP certainly aren't free on most hosts. Sure there are always solutions, like moving to a self hosted model a…
SSL/TLS is entirely a server/client exchange that has absolutely nothing to do with IP addresses. If you get the wrong certificate, you have either a crappy client, a crappy server, a misconfigured client, or a misconfigured server. For each case, there is a workaround, and that is where the inconvenience lies.
[1] SNI - http://en.wikipedia.org/wiki/Server_Name_Indication
Earlier quoted context omitted.
Unfortunately. it's not always just the cost - too many providers (e.g. DigitalOcean) obnoxiously don't support multiple IP addresses on a server/VM.
DigitalOcean is small... Windows Azure does not support multiple IPs except for hosted websites. Cloud Services or Virtual Machines get only one IP. And dedicated IPs for websites are extremely expensive.
(There may well be other reasons spinning up additional vpses for each SSL secured site doesn't suit you, but a few dollars a month price difference is surely only being used as an excuse for inaction rather that a show-stopping financial burden - at least for anyone in the top 99% of HN's demographic…)
Earlier quoted context omitted.
Business validation is what you should be using for a business site. It's actually a good thing and means that the company is interested in verifying who you are. I went through the dance with Startcom and agree with the article that the web interface has horrible workflow. However they were clearly doing their best to verify that it actually was a business they were creating an account for. For example, they ignored…
Except not even 99.9995% of your customers will know or care about the level of your SSL Cert. It really does not add anything to the equation. Just extra costs and work for you. It's been studied and pointed out that a green-bar does nothing to conversions and sales. I suggest skipping it always, but often times a higher business type will override the suggestion of whomever has to implement it and maintain it - sim…
I'm not debating this point, but if you have some citations for this assertion, I'd love to read them. I've always heard and read otherwise.
I just completed a multiple-month-long process of converting a dynamic-domain application to support SSL-friendly URIs and implementing SSL on it's web servers based entirely on the concept of adding a green bar for boosting conversions (data isn't quite in yet to verify we did anything). I would really hope that I didn't waste multiple iterations on a pipe dream.