Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hypertext Transfer Protocol Version 2

tools.ietf.org

Post reply on HN
Print view View original

31–40 of 113 posts

Re: Hypertext Transfer Protocol Version 2

#31

Post by lazyloop »

diafygi wrote: post #6

There is so much open wifi nowadays that non-https should really start to be considered harmful. A large portion of website visitors are probably connecting via Starbucks, airport wifi, etc., which means their session cookies are basically public information. So even given the mass surveillance problems, non-https connections need to start being treated as Bad Practice and discouraged by the sysadmin community.

For this to work we need free certificates. Many still keep referring to StartSSL, but there you just pay double later on in revocation fees. https://www.startssl.com/?app=43

Re: Hypertext Transfer Protocol Version 2

#32

Post by pg_is_a_butt »

wyager wrote: post #22
diafygi wrote: post #12

Earlier quoted context omitted.

Alternative? Non-https is really harmful to users who browse via open wifi.

>Alternative? There exist several semi-viable alternatives at the moment. The most promising is Namecoin, which essentially allows for cryptographically authenticated public key/value storage, and so can function as both a DNS system and a system for announcing SSL pubkeys (without any trusted parties).

trusting namecoin implementation doesn't count?

Re: Hypertext Transfer Protocol Version 2

#33

Post by duaneb »

lazyloop wrote: post #31
diafygi wrote: post #6

There is so much open wifi nowadays that non-https should really start to be considered harmful. A large portion of website visitors are probably connecting via Starbucks, airport wifi, etc., which means their session cookies are basically public information. So even given the mass surveillance problems, non-https connections need to start being treated as Bad Practice and discouraged by the sysadmin community.

For this to work we need free certificates. Many still keep referring to StartSSL, but there you just pay double later on in revocation fees. https://www.startssl.com/?app=43

No, I don't think we need free certificates, I think we need people who can carefully evaluate an untrusted certificate and make their own decision. The whole idea of a CA is pretty broken at current scale. Meanwhile, self-signed certificates are seen as a red flag. Should they be?

Re: Hypertext Transfer Protocol Version 2

#34

Post by nmjohn »

makmanalp wrote: post #30
diafygi wrote: post #6

There is so much open wifi nowadays that non-https should really start to be considered harmful. A large portion of website visitors are probably connecting via Starbucks, airport wifi, etc., which means their session cookies are basically public information. So even given the mass surveillance problems, non-https connections need to start being treated as Bad Practice and discouraged by the sysadmin community.

I completely agree, but what of the trouble of getting certificates? I have a hard time figuring out who to trust - the cheaper providers seem scammy and the expensive ones seem to be charging a lot. Self signed certs issue a big fat warning that deters users.

The cheaper ones aren't scammy - quite frankly it is the expensive ones that are the scammy ones!

I have used cheapssl.com (now ssls.com) for a number of years, probably a total of 20 sites, without a single issue.

That being said, namecheap or gandi.net also both offer reasonable priced certs.

Just so you are aware, if you think the $1,000,000 insurance policy offered with the more expensive providers is worth _anything_, be sure to read the fine print first.

The only potential more expensive thing of value is buying an EV cert to get the green URL bar - not that it actually provides even a little bit more protection, it doesn't - but because users see them and have been conditioned to immediately associate it with trust.

Re: Hypertext Transfer Protocol Version 2

#35

Post by johnny22 »

duaneb wrote: post #33
lazyloop wrote: post #31

Earlier quoted context omitted.

For this to work we need free certificates. Many still keep referring to StartSSL, but there you just pay double later on in revocation fees. https://www.startssl.com/?app=43

No, I don't think we need free certificates, I think we need people who can carefully evaluate an untrusted certificate and make their own decision. The whole idea of a CA is pretty broken at current scale. Meanwhile, self-signed certificates are seen as a red flag. Should they be?

that sounds less possible than free certificates.

Re: Hypertext Transfer Protocol Version 2

#36

Post by nitrogen »

duaneb wrote: post #33
lazyloop wrote: post #31

Earlier quoted context omitted.

For this to work we need free certificates. Many still keep referring to StartSSL, but there you just pay double later on in revocation fees. https://www.startssl.com/?app=43

No, I don't think we need free certificates, I think we need people who can carefully evaluate an untrusted certificate and make their own decision. The whole idea of a CA is pretty broken at current scale. Meanwhile, self-signed certificates are seen as a red flag. Should they be?

Opportunistic encryption of all sessions doesn't require any certificates. All that's needed is a key exchange algorithm and browser support. The UI would make it clear when a certificate was presented and validated, but no cert is needed for unauthenticated encrypted connections.

The next step up from that would be unsigned public keys with pinning (like ssh) to reduce MITM, and finally above that would be identity verification on the level of https.

Re: Hypertext Transfer Protocol Version 2

#37

Post by phaer »

duaneb wrote: post #33
lazyloop wrote: post #31

Earlier quoted context omitted.

For this to work we need free certificates. Many still keep referring to StartSSL, but there you just pay double later on in revocation fees. https://www.startssl.com/?app=43

No, I don't think we need free certificates, I think we need people who can carefully evaluate an untrusted certificate and make their own decision. The whole idea of a CA is pretty broken at current scale. Meanwhile, self-signed certificates are seen as a red flag. Should they be?

How can you (or an 'average user' whoever that might be) carefully evaluate untrusted certificates? Wouldn't i need some kind of detached information like the certificates hash signed by an already known gpg key?

The CA idea is broken but not too easy to replace. http://convergence.io/ could be a few steps forward.

Re: Hypertext Transfer Protocol Version 2

#38

Post by nitrogen »

peterwwillis wrote: post #27
diafygi wrote: post #6

There is so much open wifi nowadays that non-https should really start to be considered harmful. A large portion of website visitors are probably connecting via Starbucks, airport wifi, etc., which means their session cookies are basically public information. So even given the mass surveillance problems, non-https connections need to start being treated as Bad Practice and discouraged by the sysadmin community.

Devil's Advocate: there is no world wide cabal of wifi hackers trying to steal the Facebook login cookies of starbucks customers. The lack of security is real, but the dangers are overblown.

This particular devil needs no advocate; the risks of coffee shop MITM and dragnet surveillance are too great to ignore.

Re: Hypertext Transfer Protocol Version 2

#40

Post by diafygi »

peterwwillis wrote: post #27
diafygi wrote: post #6

There is so much open wifi nowadays that non-https should really start to be considered harmful. A large portion of website visitors are probably connecting via Starbucks, airport wifi, etc., which means their session cookies are basically public information. So even given the mass surveillance problems, non-https connections need to start being treated as Bad Practice and discouraged by the sysadmin community.

Devil's Advocate: there is no world wide cabal of wifi hackers trying to steal the Facebook login cookies of starbucks customers. The lack of security is real, but the dangers are overblown.

Currently on the front page is an article[1] about Russian malware pen testing for SQL injection. Your attack surface increases dramatically when you have valid session cookies.

A good example of this is reddit, that is not https for logged in users with write ability (and thus PostgreSQL write ability). If you have malware that sniffs public wifi traffic for reddit session cookies, you can easily start to test all those write calls for exploits.

[1] - http://www.nytimes.com/2014/08/06/technology/russian-gang-sa...

Post reply on HN