Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Switch to HTTPS Now, For Free

konklone.com

Post reply on HN
Print view View original

181–190 of 264 posts

Re: Switch to HTTPS Now, For Free

#181

Post by lmacsen »

bad_user wrote: post #17
handsomeransoms wrote: post #12

Earlier quoted context omitted.

Webfaction enabled SNI on all of their servers in December 2011 [1], which means you no longer need to buy a dedicated IP address to use SSL. In fact, when they made this switch, they switched my server over to SNI automatically and stopped charging me the extra $5/month automatically. Awesome! A small fraction of Internet users on extremely out-of-date system cannot use SNI. If you need to support those users, you w…

Any IExplorer on Windows XP, Safari on Windows XP, Android 2.x, Blackberry, Symbian, Java before 1.7, Windows Mobile up to 6.5 ... the list is quite significant. Depending on your target, you can easily talk about 25% of the traffic.

Stop feeding zombies with outdated browsers. :)

Re: Switch to HTTPS Now, For Free

#182

Post by ivanr »

espeed wrote: post #90
konklone wrote: post #65

Earlier quoted context omitted.

SSL Labs does a great job of SSL testing domains and making recommendations: https://www.ssllabs.com/ssltest/analyze.html?d=konklone.com I developed my nginx config based on their recommendations: https://gist.github.com/konklone/6532544

Instead of using nginx or a Web server for SSL, you might consider using something like stunnel for SSL termination as recommended by 'cperciva: "...for security reasons, I prefer to keep SSL termination separate from HTTP serving" ( http://colin.percival.usesthis.com , http://www.daemonology.net/blog/2009-09-28-securing-https.ht... ). In his 2010 talk "Everything you need to know about cryptography in 1 hour" ( http…

Deploying SSL partially is very dangerous, because then you have to be _very_ careful that the session ID is not compromised. I'd go as far as to say that it's virtually impossible to do that securely (for the average web site, built by more than one person who are not security experts, maintained under pressure over a period of years, and so on).

Someone else here mentioned SSL stripping, which is another problem, which you can't avoid [with partial SSL] no matter how much you try.

If you're deploying SSL today and you're not using HTTP Strict Transport Security, you're doing it incorrectly.

Re: Switch to HTTPS Now, For Free

#183

Post by andrewaylett »

al2o3cr wrote: post #128
jackalope wrote: post #116

Earlier quoted context omitted.

SSL/TLS is entirely a server/client exchange that has absolutely nothing to do with IP addresses. If you get the wrong certificate, you have either a crappy client, a crappy server, a misconfigured client, or a misconfigured server. For each case, there is a workaround, and that is where the inconvenience lies.

Mostly true now, but not historically true - until SNI [1] was rolled out widely, implementing SSL absolutely required a dedicated IP. Short story shorter, the TLS handshake happens before the Host: header exchange in HTTP; before SNI there wasn't any way for a host that responded to multiple names to identify which cert to use for the handshake. [1] SNI - http://en.wikipedia.org/wiki/Server_Name_Indication

That's still not quite true -- subject alternative names allow you to put multiple domains on a single certificate. That does raise trust issues if you're doing shared hosting, but it should be fine if you run all of the sites and don't mind them being obviously linked.

Re: Switch to HTTPS Now, For Free

#184

Post by ivanr »

rurounijones wrote: post #139
tjohns wrote: post #21

Earlier quoted context omitted.

There are some minor caveats, but nothing really worth worrying about. Most browsers accept StartCom certs these days, so that's not a concern unless you're supporting ancient systems. The big difference is in how much validation is done. The cheap certs only offer domain verification; in other words, they verify that the person holding the certificate owns the domain in question. Typically via an automated email to…

The fact that EV certificates exist in the first place is an indication in my mind just how badly CAs messed up the certs originally. ("We need to sell more! Get rid of the checks") It also drives me nuts that browsers still class self-signed certs below normal (non-ev) certs when they basically offer the same level of guarantees (in terms of "this person is who they claim to be")

You are wrong. Attacks against sites with self-signed certificates are trivial to execute (you just need to download the tools and learn how to run them) and can be fully automated. Obtaining fraudulent certificates is occasionally possible (getting more difficult every day), but it generally needs to be done one site at a time, and requires a _lot_ of resources.

That said, there are many ways in which browsers could improve the handling of self-signed certificates. For example, having a Convergence-like system to fall back to seems useful. Another possibility would be to use opportunistic encryption, where all access is encrypted even without a certificate. (This would defend only against passive attackers, but it's better than no encryption.)

Re: Switch to HTTPS Now, For Free

#185

Post by dspillett »

raphinou wrote: post #177
powertower wrote: post #136

Earlier quoted context omitted.

> I've always heard and read otherwise. Those "Get better conversion rates with EV Certs" internal studies are pure marketing B.S. by the SSL vendors. Do not trust what they say. Every single person that has tested this on his site has come to the same exact conclusion - the green-bar has no meaning to the consumer, nor do they even notice it. http://www.theroiteam.com/blog/is-an-ev-ssl-worth-it-or-even... http://web…

The first link mentions EV certificate handshake is slower. Is that really the case? What is the reason?

I'd like to see some facts to back that up: I suspect it is bunk, another problem somewhere that has been mistakenly attributed to the certificate type (perhaps they altered other SSL options on their web server at the same time as changing the cert, or the non-EV cert uses smaller keys so takes less CPU time to process).

The EV certs contain extra information so are likely to be a little larger, but we are talking at most a couple of hundred bytes here so the extra download time getting the cert and CPU time verifying things are not going to be significant.

People do tend to have larger key sizes on EV certs (2048 or 4096 bit rather than 1024 or 2048 (though 1024 bit keys are increasingly rare even for "standard" certificates)) which might impose a measurable latency difference on a mobile (or other low-power) device due to the math involved in verifying the site against the certificate, but nothing like the order of magnitude that link mentions.

Re: Switch to HTTPS Now, For Free

#186

Post by 0x006A »

mcv wrote: post #67
hcarvalhoalves wrote: post #64

If browsers got fixed to not freak out on self-signed certificates, this wouldn't even be an issue, HTTPS could be a default.

But how do you distinguish a self-signed certificate from a MITM NSA-signed one?

NSA does not use self-signed certificates for MITM, they have access to certificate authorities to get there own certificates that show up as valid in your browser.

Re: Switch to HTTPS Now, For Free

#187

Post by gmac »

aroch wrote: post #144
mcv wrote: post #72

Is it irony that Safari considers his $0 certificate unsafe, or did he simply get what he paid for?

Safari (wel, the OSX Keychain) doesn't include StartCOM in it's Truststore -- which I'm pretty OK with. I revoke it from all my trsutstores

(a) That's not my experience. This site of mine is secured with a StartCom cert, and Safari has always been perfectly happy with it: https://mappiness.me

(b) Why? I understood they were among the better providers.

Re: Switch to HTTPS Now, For Free

#188

Post by barrydahlberg »

cenhyperion wrote: post #113
barrydahlberg wrote: post #94

Earlier quoted context omitted.

Can you please clarify exactly what you mean by compression? Is this referring to typical gzip compression in HTTP results or something else?

>Is this referring to typical gzip compression in HTTP Yes. It's a major vulnerability discovered in the past few months that significantly weakens the crypto. Website Describing the attack: http://breachattack.com/ Django Blog Post: https://www.djangoproject.com/weblog/2013/aug/06/breach-and-...

That's not cool. The last thing we need is more things for people to use as reasons for not using HTTPS at all.

Re: Switch to HTTPS Now, For Free

#189

Post by mcv »

gmac wrote: post #187
aroch wrote: post #144

Earlier quoted context omitted.

Safari (wel, the OSX Keychain) doesn't include StartCOM in it's Truststore -- which I'm pretty OK with. I revoke it from all my trsutstores

(a) That's not my experience. This site of mine is secured with a StartCom cert, and Safari has always been perfectly happy with it: https://mappiness.me (b) Why? I understood they were among the better providers.

> This site of mine is secured with a StartCom cert, and Safari has always been perfectly happy with it: https://mappiness.me

My Safari can't verify the identity of that website. This is Safari 5.1.7.

Re: Switch to HTTPS Now, For Free

#190

Post by AhtiK »

bigiain wrote: post #131
AhtiK wrote: post #89

> And hey, bonus: more complete referrer information in Google Analytics It's interesting, I did switch to HTTPS for all my sites but Google Search still did not reveal search keywords to Google Analytics from users logged in at Google. If that's what was referred as "referrer information". Did anyone get lucky with getting 100% of google search keywords after switching to SSL?

What he meant was that Google Analytics will correctly identify visitors coming from a link on a SSL secured site (for example https://news.ycombinator.com ) if your set is SSL secured as well - all browsers strip the referrer header if they're going from an https page to an http one. Google search queries/keywords are a different issue - Google is intentionally making it impossible to see most of those (presumably,…

Many thanks for clearing that up! I had no idea browsers strip referrer headers with https->http navigation.
Post reply on HN