Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Switch to HTTPS Now, For Free

konklone.com

Post reply on HN
Print view View original

151–160 of 264 posts

Re: Switch to HTTPS Now, For Free

#151

Post by victorf »

dgesang wrote: post #143
dpe82 wrote: post #25

Earlier quoted context omitted.

Someone should probably point out: most of your problems were related to doing full business validation from a crappy provider. Business validation is optional and doesn't enhance the transport-layer security benefits of using SSL.

Someone should probably also point out: most of the CAs are more or less equally 'crappy'. We've been through many CAs now and none of them has a process anywhere near 'perfect'. Btw, Comodo customer support is rather nice. We recently bought a code signing certificate from them and they walked us through the whole process via chat, worked quite well and we were done in about 30 min.

Do you not feel that, due to the security failure in 2011, they are one of the worst? I typically disable their certificate on my machines. The CA system is totally flawed anyway, I don't know why I bother.

Re: Switch to HTTPS Now, For Free

#152

Post by micro-ram »

dangrossman wrote: post #14
handsomeransoms wrote: post #12

Earlier quoted context omitted.

Webfaction enabled SNI on all of their servers in December 2011 [1], which means you no longer need to buy a dedicated IP address to use SSL. In fact, when they made this switch, they switched my server over to SNI automatically and stopped charging me the extra $5/month automatically. Awesome! A small fraction of Internet users on extremely out-of-date system cannot use SNI. If you need to support those users, you w…

Almost 1 in 5 people on the web are still running Windows XP. No version of Internet Explorer on XP supports SNI. Neither does Safari on XP, the browser in Android 2.x, the BlackBerry browser or Opera Mobile before 10.1. It may be a minority of users, but it's not just "people who are still running IE6". Pretty much everyone would love to use SNI; site owners wouldn't have to pay for extra IPs, hosting companies woul…

Yes, XP does not support SNI. Users will be presented with a certificate error however the correct site will be served. It will just have the wrong cert. If this is not a deal breaker for the small percentage of XP traffic expected you should use SNI anyway. Maybe a javascript check to point out to the user why the wrong cert was displayed would nudge them to upgrade.

Re: Switch to HTTPS Now, For Free

#153

Post by vacri »

powertower wrote: post #117
vacri wrote: post #60

Earlier quoted context omitted.

Business validation is what you should be using for a business site. It's actually a good thing and means that the company is interested in verifying who you are. I went through the dance with Startcom and agree with the article that the web interface has horrible workflow. However they were clearly doing their best to verify that it actually was a business they were creating an account for. For example, they ignored…

Except not even 99.9995% of your customers will know or care about the level of your SSL Cert. It really does not add anything to the equation. Just extra costs and work for you. It's been studied and pointed out that a green-bar does nothing to conversions and sales. I suggest skipping it always, but often times a higher business type will override the suggestion of whomever has to implement it and maintain it - sim…

I think you make a fair point on the level-of-cert point. I got the first level of their business cert offerings because I needed a wildcard cert - we still don't have the EV green padlock.

I guess I was more trying to convey that it's reassuring to know that Startcom (at least) go to some effort to investigate their verification, and it's not just a bits-in-bits-out process.

This being said, I'm in a business and if I leave and another ops person comes along, the semantics of 'business' versus 'personal' account makes their job a little easier. I'm certainly not an expert in the area of SSL, but from long experience in other fields, it's a pain in the arse managing 'business accounts' that are really repurposed individual/private accounts.

Re: Switch to HTTPS Now, For Free

#154

Post by paulgerhardt »

micahflee wrote: post #141
zmmmmm wrote: post #102

Do people trust StartCom? Just curious ... I always wondered why you have all these very expensive cert providers who charge a lot for SSL certs, and then this mysterious company with ties to Israel is handing them out for free? I know it's pure paranoia, but this would seem to be an excellent way to compromise a lot of SSL traffic if you were into that, and the Israelis are pretty famous for all kinds of spying acti…

It doesn't particularly matter if people trust StartSSL, it matters if browsers trust them (which they do). There are about 100 root CAs, and something like 1000 CAs if you include intermediates (controlled by ~650 different organizations - https://www.eff.org/observatory ), and browsers trust ALL of them. All it takes is one to issue a malicious cert, or to get hacked, to do a MITM attack on ANY domain without showi…

>it matters if browsers trust them (which they do).

We had endless problems with StartSSL on mobile browsers. They have only recently been added to the latest Windows Mobile 8 repo and you can forget about any phone OS (except iOS) that was released before 2012.

The thing with SSL providers is most people think if it works on Chrome and IE they're set, but for certain businesses they need something that will work on the Wii Browser, an IBM Power System, or an older dumbphone. SmartTV's in particular are pretty annoying to get any CA list because whoever implemented the browser portion on the devices probably just imported some random Java lib from circa 2002.

If you are doing something small and personal, StartCom is just fine. If you're running a business, at some point it may become inevitable that you switch to oldest provider you can reasonably sign up for, in particular one of the Original Three (Thawte, GlobalSign, or Verisign). If you're running a non-profit advocating for privacy and cryptography where a large number of your users may be based in the middle east running on legacy hardware, you may want to take a cursory look to see if your users are getting any cert problems and get a cert from Thawte (the cheapest of the three - though you will need to chain to an intermediary cert if you got with their 123 option).

Re: Switch to HTTPS Now, For Free

#155

Post by cbhl »

jakobe wrote: post #69
JoshTriplett wrote: post #51

Earlier quoted context omitted.

If you're willing to write off users of Internet Explorer on Windows XP, you don't need a dedicated IP for SSL; you can simply use Server Name Indication (SNI).

But then I'd need to support SSL for all domains hosted on the server, and this would mean getting 5 certificates instead of one.

You'd need at most two IP addresses to resolve this problem: one for HTTP/HTTPS sites, and one for HTTP-only sites.

Re: Switch to HTTPS Now, For Free

#157

Post by espeed »

espeed wrote: post #112
chc wrote: post #101

Earlier quoted context omitted.

> In his 2010 talk "Everything you need to know about cryptography in 1 hour" ( http://blip.tv/fosslc/everything-you-need-to-know-about-cryp... ), Colin also recommends limiting SSL use to a confined area. Doesn't this leave you vulnerable to session theft?

The session ID is encoded into each URL or Form, and the request is signed using an HMAC-SHA-256 signature.

UPDATE: Looking again at Amazon.com's current HTML, it does not appear that Amazon.com is securing all requests so it may be vulnerable.

Re: Switch to HTTPS Now, For Free

#158

Post by jlgaddis »

Note that in addition to using it for your web site, you can also use this same certificate for e-mail, assuming you run your own mail server.

Long story short: I recently moved my e-mail from Google Apps to a machine under my control. As part of that project, I "redeemed" an unused SSL certificate I had purchased a while back for Postfix and Dovecot.

(While I paid for mine, you can use a self-signed one and most MTAs won't complain or refuse to deliver mail, if memory serves.)

Re: Switch to HTTPS Now, For Free

#159

Post by ars_technician »

jakobe wrote: post #38
dangrossman wrote: post #24

Earlier quoted context omitted.

I would be willing to bet over 95% of SSL-secured sites don't have business validation certificates. Given virtually nobody visiting your site will know what that means, let alone how to check anything about the certificate you're using, it just doesn't make sense to pay extra for no benefit. A domain-validated certificate costs less while providing the same padlock icon and level of encryption, and takes just minute…

In my case, I don't care about encryption. On my website, I only offer software for download. No private data. Payment is handled by a third party. The only reason why I want to support https is so that customers can confirm who they are downloading from. Ideally, I'd like an EV certificate, but I can't afford that. So I chose a business validation cert. A domain only certificate wouldn't really confirm anything. (Al…

Sorry, but you are still wasting your money on a business validation certificate. A domain validation certificate is the only thing that a browser actually validates and ensures the security between you and the website. The rest is just sprinkles on top to make people feel better and to charge website owners extra money.

Re: Switch to HTTPS Now, For Free

#160

Post by ars_technician »

uxp wrote: post #133
jbrechtel wrote: post #84

Earlier quoted context omitted.

That's not true. Why do you think that?

Actually it is, because you'd still have a domain pointed to an IP address listening on 443, and that IP address wouldn't know how to handle the domain that is not configured to listen on 443, so it would serve the default domain (generally the first SSL-configured domain with Apache, or 'default_server' on Nginx). This means you'll be serving a certificate for your default site 'foo.com' when you requested 'bar.org'…

People wouldn't be connecting to the website using HTTPS if it didn't have a certificate in the first place, so why does it matter if 'bar.org' doesn't have a certificate?
Post reply on HN