Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bing now supports https

bing.com

Post reply on HN
Print view View original

21–30 of 48 posts

Re: Bing now supports https

#22

Post by pbsd »

tptacek wrote: post #17
higherpurpose wrote: post #16

Don't forget to add PFS, Microsoft. And no NIST-corrupted curves, please.

In other words, don't use elliptic curves? And, therefore, don't use forward secrecy? Does current browser support for curves even allow you to set up a "NIST-free" ECDHE TLS server?

There's also DHE, which is not "NIST-corrupted" I guess. As far as I know, in theory it should be possible to use the Brainpool curves in TLS, but haven't seen such a thing in actual use.

Re: Bing now supports https

#23

Post by bjackman »

jared314 wrote: post #5

For some context: https://news.ycombinator.com/item?id=5576041 (8 months ago) https://news.ycombinator.com/item?id=6937686 (1 month ago) http://www.zdnet.com/bing-is-fine-insecure-as-ever-but-fine-... (April 2013) > Bing has never supported secure connections...

Not only did it not support secure connections (which on its own is kind of shitty, but not laughing-stock material IMO), but it also failed to fail elegantly when you attempted to make a secure connection.

Re: Bing now supports https

#24

Post by booi »

aabalkan wrote: post #21
semenko wrote: post #8

They get an A from Qualys (yay?): https://www.ssllabs.com/ssltest/analyze.html?d=bing.com … but no PFS :/

LOL even my blog with free SSL cert from startssl gets A. I suppose that's nothing to brag about. https://www.ssllabs.com/ssltest/analyze.html?d=ahmetalpbalka...

Setting up SSL/TLS on a single server in a virtual environment that you don't even have to manage is a different story than getting major changes tested and deployed on a huge multi-billion dollar, multi-tenant distributed system spanning not just the globe but multiple teams, languages, people and requirements.

Re: Bing now supports https

#27

Post by higherpurpose »

tptacek wrote: post #17
higherpurpose wrote: post #16

Don't forget to add PFS, Microsoft. And no NIST-corrupted curves, please.

In other words, don't use elliptic curves? And, therefore, don't use forward secrecy? Does current browser support for curves even allow you to set up a "NIST-free" ECDHE TLS server?

You're using the same argument RSA used when they decided to just keep Dual EC DRBG, because it was "too late to change", even though they knew it was a backdoor. Granted, I think they are lying and did it on purpose, but even their lie is pretty bad logic.

They need to talk to Google, Mozilla and others, and decide on using a new set of safe curves in their browsers. Using a broken one is not a solution.

Re: Bing now supports https

#29

Post by DannyBee »

booi wrote: post #24
aabalkan wrote: post #21

Earlier quoted context omitted.

LOL even my blog with free SSL cert from startssl gets A. I suppose that's nothing to brag about. https://www.ssllabs.com/ssltest/analyze.html?d=ahmetalpbalka...

Setting up SSL/TLS on a single server in a virtual environment that you don't even have to manage is a different story than getting major changes tested and deployed on a huge multi-billion dollar, multi-tenant distributed system spanning not just the globe but multiple teams, languages, people and requirements.

Just so i'm clear, your argument is essentially: we should be more impressed more because they designed it in a way that made it difficult for them to do this?
Post reply on HN