Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Switch to HTTPS Now, For Free

konklone.com

Post reply on HN
Print view View original

211–220 of 264 posts

Re: Switch to HTTPS Now, For Free

#211

Post by tptacek »

tedunangst wrote: post #120
dragonwriter wrote: post #99

Earlier quoted context omitted.

You can't have protection from eavesdropping without protection from MITM, because MITM can be used for eavesdropping (as well as actually inserting malicious traffic into the communication.) Which is why encryption without authentication is pointless (or, worse, illusory security) in most cases. On the internet, your communication is inherently being handed off through a number of intermediaries to an endpoint. If y…

I agree and disagree. Not all adversaries have active intercept capabilities. Some are just passive. Defending against them isn't entirely pointless. I really, really dislike the CA cabal. Self signed "encrypt only" certs combined with auto cert pinning in browsers would probably solve 99% of the problem.

What's a "just passive" adversary, other than a "potentially active adversary that chooses not to use the information they're collecting to leverage an active attack"?

Nobody likes the CA problem, but you can't handwave the problem away.

TACK (which provides auto-pinning) is hopefully going to be a solution to the lack of trustworthiness in CAs, but TACK's deployment model also presumes a CA infrastructure.

Re: Switch to HTTPS Now, For Free

#212

Post by asdasf »

majelix wrote: post #196
dpe82 wrote: post #25

Earlier quoted context omitted.

Someone should probably point out: most of your problems were related to doing full business validation from a crappy provider. Business validation is optional and doesn't enhance the transport-layer security benefits of using SSL.

> Business validation is optional and doesn't enhance the transport-layer security benefits of using SSL. Except that SSL isn't just about transport-layer security, it's also about identity. The entire model of SSL breaks down if anyone can buy a certificate for anything.

Which browser makes it clear to the user that some unknown organization has "verified" the business hosting the domain they are at? All a user sees is a little lock, no matter what cert you buy.

Re: Switch to HTTPS Now, For Free

#213

Post by asdasf »

majelix wrote: post #195
powertower wrote: post #117

Earlier quoted context omitted.

Except not even 99.9995% of your customers will know or care about the level of your SSL Cert. It really does not add anything to the equation. Just extra costs and work for you. It's been studied and pointed out that a green-bar does nothing to conversions and sales. I suggest skipping it always, but often times a higher business type will override the suggestion of whomever has to implement it and maintain it - sim…

> It really does not add anything to the equation. Just extra costs and work for you. Of course it adds something: It makes it more difficult for someone else to go buy a SSL certificate in your name. Security isn't just about driving sales, it's also about protecting yourself and your customers.

> It makes it more difficult for someone else to go buy a SSL certificate in your name

No it doesn't. Just because you wasted money on a joke process, doesn't mean "evil attacker X" has to do it too. They can just go ahead and buy a regular cert for your domain still.

Re: Switch to HTTPS Now, For Free

#214

Post by tptacek »

valtron wrote: post #107
dragonwriter wrote: post #99

Earlier quoted context omitted.

You can't have protection from eavesdropping without protection from MITM, because MITM can be used for eavesdropping (as well as actually inserting malicious traffic into the communication.) Which is why encryption without authentication is pointless (or, worse, illusory security) in most cases. On the internet, your communication is inherently being handed off through a number of intermediaries to an endpoint. If y…

Still, having #1 is still better than neither. Instead of the NSA (sorry for beating a dead horse) simply siphoning your plaintext off the wire, isn't it more secure if you force them to have to actively fudge every single key exchange in order to read your traffic? (The "locks on doors" argument.)

The problem with this argument is that you don't need to be the NSA to compromise an unauthenticated encrypted channel; that's a task well within the capabilities of online criminals.

Re: Switch to HTTPS Now, For Free

#215

Post by asdasf »

majelix wrote: post #198
aioprisan wrote: post #166

Earlier quoted context omitted.

You're really just wasting your time with a "business validated" certificate. The browser doesn't treat it any differently and consumers like my parents would not know the difference or know what to look for. It's all (brilliant) marketing, nothing else. You're equally secure with a PositiveSSL cert from namecheap.com for $8 (or free with a domain registration)..

> You're really just wasting your time with a "business validated" certificate. The browser doesn't treat it any differently If your vendor doesn't do a decent job verifying who you are (and this may or may not mean EV), then browsers won't treat the certificate any differently when it's entirely replaced by someone else either.

It doesn't matter how good a job your vendor does, if there is a vendor that does a bad job, then the attacker can get a cert from them. The presence of a single bad cert authority renders all certificates useless.

Re: Switch to HTTPS Now, For Free

#216

Post by asdasf »

mattlutze wrote: post #193
ars_technician wrote: post #159

Earlier quoted context omitted.

Sorry, but you are still wasting your money on a business validation certificate. A domain validation certificate is the only thing that a browser actually validates and ensures the security between you and the website. The rest is just sprinkles on top to make people feel better and to charge website owners extra money.

>> so that customers can confirm who they are downloading from This would seem that he was in fact looking to provide "some sprinkles [to] make his customers feel better." Perhaps not a waste of money, then, if it provided what he was looking for?

The sprinkles are for people buying certs, not the customers of the people buying certs. End users don't even know he got a different cert, or what that means.

Re: Switch to HTTPS Now, For Free

#217

Post by aroch »

gmac wrote: post #187
aroch wrote: post #144

Earlier quoted context omitted.

Safari (wel, the OSX Keychain) doesn't include StartCOM in it's Truststore -- which I'm pretty OK with. I revoke it from all my trsutstores

(a) That's not my experience. This site of mine is secured with a StartCom cert, and Safari has always been perfectly happy with it: https://mappiness.me (b) Why? I understood they were among the better providers.

a) Well, if you setup your startcom SSL cert with the browser, that means you've been forced to add StartCOM to your truststores.

b) I simply don't trust them, particularly since they use a keybased auth system -- any compromised computer that was used to setup a startcom cert can download the private keys

Re: Switch to HTTPS Now, For Free

#218

Post by baudehlo »

asdasf wrote: post #212
majelix wrote: post #196

Earlier quoted context omitted.

> Business validation is optional and doesn't enhance the transport-layer security benefits of using SSL. Except that SSL isn't just about transport-layer security, it's also about identity. The entire model of SSL breaks down if anyone can buy a certificate for anything.

Which browser makes it clear to the user that some unknown organization has "verified" the business hosting the domain they are at? All a user sees is a little lock, no matter what cert you buy.

EV Certs show the company identity, which has been verified. Go to paypal for an example.

Re: Switch to HTTPS Now, For Free

#219

Post by tlrobinson »

chc wrote: post #36

Just going to throw out that if you use a Cloudflare business plan, you can just tick a couple of boxes and get SSL for free.

While I like Cloudflare, it's worth noting you give up true "end to end" encryption SSL normally provides. It's entirely possible for Cloudflare to allow others to eavesdrop on your traffic, and in fact I think the connections between Cloudflare and your servers are normally unencrypted.

Basically, using Cloudflare SSL is good for protecting your customers from eavesdroppers on WiFi, not so good for protecting against NSA surveillance. But it's probably better than nothing.

Re: Switch to HTTPS Now, For Free

#220

Post by Trakzstarz »

barrydahlberg wrote: post #188
cenhyperion wrote: post #113

Earlier quoted context omitted.

>Is this referring to typical gzip compression in HTTP Yes. It's a major vulnerability discovered in the past few months that significantly weakens the crypto. Website Describing the attack: http://breachattack.com/ Django Blog Post: https://www.djangoproject.com/weblog/2013/aug/06/breach-and-...

That's not cool. The last thing we need is more things for people to use as reasons for not using HTTPS at all.

In other words, you think it's a dickish?

LOL! Kids...

Post reply on HN