Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Hacker News' “most unique support email of 2014”

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 120 posts

Re: Show HN: Hacker News' “most unique support email of 2014”

#41

Post by agwa »

Animats wrote: post #8
leesalminen wrote: post #4

My gut says that they've disabled SSL v2/v3, and that the device does not support TLS.

Security Theater Everywhere strikes again. Unless you're logged in and entering data, Hacker News does not need SSL.

In addition to thwarting state-sponsored attacks mentioned by geofft, HTTPS also prevents ISPs and hotels from injecting ads[1,2]. And using HTTPS even for logged-out users prevents an attacker from sslstripping[3] the link to the login page, which is good because even the most careful users won't always notice when a login page is suddenly served over an insecure connection.

As a user of HN, I appreciate these security features. Suggesting that HN should not use HTTPS so that someone can access it from a 10 year old device that's impractical for modern web browsing anyways is possibly the weakest argument you can make against HTTPS.

[1] http://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-f...

[2] http://justinsomnia.org/2012/04/hotel-wifi-javascript-inject...

[3] http://www.thoughtcrime.org/software/sslstrip/

Re: Show HN: Hacker News' “most unique support email of 2014”

#42

Post by chrissnell »

alfiedotwtf wrote: post #11
Animats wrote: post #8

Earlier quoted context omitted.

Security Theater Everywhere strikes again. Unless you're logged in and entering data, Hacker News does not need SSL.

> Unless you're logged in and entering data, Hacker News does not need SSL What about if you're in a country that likes to censor the news?

Why not create a non-SSL virtualhost? http://plain.news.ycombinator.com or similar.

Re: Show HN: Hacker News' “most unique support email of 2014”

#43

Post by yourad_io »

j45 wrote: post #9

My palm Treos are still the most productive devices I've ever owned. Android is starting to get close but that keyboard and shortcut keys to go directly into an app on the Treo has been unrivalled. Hoping with the sale of the Palm Trademark, and WebOS being free, which is a generation ahead of all mobile operating systems, before the javascript app craze came up, might, in some way, come to lead and inspire the way a…

I was recently looking for a sliding qwerty keyboard phone and to my dismay I realised that while we weren't looking, the NSA took them all away!

In my quest I found a phone database where you can search by features (I forget which one right now) and sorted through all possible candidates. My hopes went up momentarily when I saw the Dell Venue Pro[1] before I clicked "next" and saw how wrong they got it[2].

Eventually I sumbled on the Motorola Photon Q[3] - which I'm not even supposed to have, as it doesn't come with a SIM slot at all. Luckily some enterprising Korean guys have figured out the modding process and are selling them on ebay. I tried my luck and received it a few days ago. Really good value for money, loving the sliding action and physical keys but wish it were a bit more powerful. I think I've compensated for this mostly by cutting out a lot of fat and its puny dual core CPU now runs 4.4 fairly comfortably. I'll probably go back to my Nexus 5 soon but it's a great backup phone and I love the keyboard.

I'm half convinced that a custom N4/5 backplate with a built-in keyboard would sell like crazy. #kickstarterideas

TL;DR: Look at Moto Photon Q.

[1] http://upload.wikimedia.org/wikipedia/commons/7/7c/Dell_Venu...

[2] http://cdn.slashgear.com/wp-content/uploads/2010/10/dell_ven... I literally burst out laughing as soon as I saw this. Bless you, Dell. (also: windows)

[3] http://upload.wikimedia.org/wikipedia/commons/8/8d/Motorola_...

Re: Show HN: Hacker News' “most unique support email of 2014”

#44

Post by chrismorgan »

rizumu wrote: post #15

Uniqueness is absolute, so the support email is either unique or not. There are no degrees of uniqueness for something to be more unique than another thing. Sorry, but this grammar mistake is a big pet peeve.

I would urge you to, like I realised I had to a few years ago, get over it. Language is not defined by a dictionary or by history; roots and origins are truly meaningless. A word is defined by its usage; it’s one of the delightful things in the world for which it can be said that if enough people say something is true, it becomes true.

Uniqueness may once have been a boolean property (I cannot say for certain one way or another), but at present it is not.

Re: Show HN: Hacker News' “most unique support email of 2014”

#45

Post by [deleted] »

agwa wrote: post #41
Animats wrote: post #8

Earlier quoted context omitted.

Security Theater Everywhere strikes again. Unless you're logged in and entering data, Hacker News does not need SSL.

In addition to thwarting state-sponsored attacks mentioned by geofft, HTTPS also prevents ISPs and hotels from injecting ads[1,2]. And using HTTPS even for logged-out users prevents an attacker from sslstripping[3] the link to the login page, which is good because even the most careful users won't always notice when a login page is suddenly served over an insecure connection. As a user of HN, I appreciate these secur…

[deleted]

Re: Show HN: Hacker News' “most unique support email of 2014”

#46

Post by roywiggins »

agwa wrote: post #41
Animats wrote: post #8

Earlier quoted context omitted.

Security Theater Everywhere strikes again. Unless you're logged in and entering data, Hacker News does not need SSL.

In addition to thwarting state-sponsored attacks mentioned by geofft, HTTPS also prevents ISPs and hotels from injecting ads[1,2]. And using HTTPS even for logged-out users prevents an attacker from sslstripping[3] the link to the login page, which is good because even the most careful users won't always notice when a login page is suddenly served over an insecure connection. As a user of HN, I appreciate these secur…

T-Mobile opted me in to a content filter by default. To remove it, last I saw I needed to give them my SSN (!!!). So, I live with the idiot filter, which actually scans for keywords in websites and blocks them. SSL obviously makes this sort of filtering useless, which is very useful.

Re: Show HN: Hacker News' “most unique support email of 2014”

#47

Post by Animats »

geofft wrote: post #26
Animats wrote: post #13

Earlier quoted context omitted.

Protection against changes should be done with subresource integrity hashes ( http://www.w3.org/TR/SRI/ ). With HTTPS, an observer still knows who you're talking to, and since they can see how big the request and reply are, they can probably guess what you're looking at.

I totally agree (although you need more than SRI, since you also need some way of signing the original content, but I'd love to see a full spec for this sort of thing). However, SSL is what we have right now that works. And I think, of the browsers that do support SRI (possibly in prerelease versions or behind feature flags), they require the page to be delivered over SSL anyway.

HTTPS is broken by content delivery networks who terminate SSL connections. HTTPS Everywhere makes the problem worse, by increasing load for static pages and breaking caches, forcing sites to use a content delivery network.

Take a look at that HTTPS certificate that you think means you're talking to the site of your choice. If it says "cloudflare.com", "incapsula.com", "edgecastcdn.com", "palmwebservices.com", "cdnetworks.net", there is a man in the middle of your HTTPS connection. This is the case for at least 38,000 sites we know about. There are probably more. (The list: http://john-nagle.github.io/certscan/whoamitalkingto04.pdf)

HTTPS Everywhere was well-intentioned, but the people behind it didn't realize that high-volume use of HTTPS forced less secure use of HTTPS. That's why it's a form of security theater.

Re: Show HN: Hacker News' “most unique support email of 2014”

#48

Post by nailer »

Animats wrote: post #8
leesalminen wrote: post #4

My gut says that they've disabled SSL v2/v3, and that the device does not support TLS.

Security Theater Everywhere strikes again. Unless you're logged in and entering data, Hacker News does not need SSL.

Firesheep would allow some guy at your coffee shop or conference to steal your user account. SSL would stop them.

Re: Show HN: Hacker News' “most unique support email of 2014”

#49

Post by nitrogen »

Animats wrote: post #47
geofft wrote: post #26

Earlier quoted context omitted.

I totally agree (although you need more than SRI, since you also need some way of signing the original content, but I'd love to see a full spec for this sort of thing). However, SSL is what we have right now that works. And I think, of the browsers that do support SRI (possibly in prerelease versions or behind feature flags), they require the page to be delivered over SSL anyway.

HTTPS is broken by content delivery networks who terminate SSL connections. HTTPS Everywhere makes the problem worse, by increasing load for static pages and breaking caches, forcing sites to use a content delivery network. Take a look at that HTTPS certificate that you think means you're talking to the site of your choice. If it says "cloudflare.com", "incapsula.com", "edgecastcdn.com", "palmwebservices.com", "cdnet…

HTTPS Everywhere was well-intentioned, but the people behind it didn't realize that high-volume use of HTTPS forced less secure use of HTTPS. That's why it's a form of security theater.

I still trust the link between CloudFlare and Hacker News more than I trust the link between a dodgy ISP and Hacker News. Further, there's no reason that a CDN can't use SSL to the backend, so in that case the only weak point is the CDN and the original site, not any of the links.

Using HTTPS to a CDN is still far better than using HTTP to a CDN or to the original site.

Re: Show HN: Hacker News' “most unique support email of 2014”

#50

Post by CamperBob2 »

roywiggins wrote: post #46
agwa wrote: post #41

Earlier quoted context omitted.

In addition to thwarting state-sponsored attacks mentioned by geofft, HTTPS also prevents ISPs and hotels from injecting ads[1,2]. And using HTTPS even for logged-out users prevents an attacker from sslstripping[3] the link to the login page, which is good because even the most careful users won't always notice when a login page is suddenly served over an insecure connection. As a user of HN, I appreciate these secur…

T-Mobile opted me in to a content filter by default. To remove it, last I saw I needed to give them my SSN (!!!). So, I live with the idiot filter, which actually scans for keywords in websites and blocks them. SSL obviously makes this sort of filtering useless, which is very useful.

Wow. This is in the US, I assume ("SSN")? I've never heard of this happening with a US carrier.
Post reply on HN