Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blink - Intent to deprecate: Insecure usage of powerful features

groups.google.com

Post reply on HN
Print view View original

91–96 of 96 posts

Re: Blink - Intent to deprecate: Insecure usage of powerful features

#91

Post by nknighthb »

ldng wrote: post #87
nknighthb wrote: post #68

Earlier quoted context omitted.

> Do you really need to secure Youtube viewing on a public WiFi hotspots ? This suggests you did not, in fact, see the problem. The attacker in this scenario is not limited to replacing YouTube videos. They can make anything they want appear on the user's screen, including things like a Google login page, or even a bank login page.

You're probably right, I am not a security expert and might not be seeing the whole picture. You log into your bank website connected to an open WiFi hotspot ? I never would do that. I think there is a point where you have to apply common sense. I do not care about the downvote, my opinion is what it is and I maintain my position. As I see it (me not been a field expert), HTTPS Everywhere will not save the world. You…

> You log into your bank website connected to an open WiFi hotspot ? I never would do that.

Many people do that, and it's quite safe to do so with a modern browser. Were it not, it would not be safe to do so in any context, because man-in-the-middle attacks are possible on any connection, just extra easy on wifi.

> I think there is a point where you have to apply common sense.

As you are demonstrating quite well here, "common" sense is not good sense. It is stopping you from doing things which are safe, and making you advocate for things which are unsafe.

> I access my through HTTPS explicitly typing the URL.

You would be typing the URL into the equivalent of a remote desktop session. That is what you're not understanding.

> My bank ask confirmation out of band for every dangerous action (by SMS).

1) Most banks do not do that.

2) SMS is not a secure channel.

3) Banks are not the only target (again, google/gmail accounts are another good example).

4) Even if they could not transfer funds, they would now have a great deal of information about your finances right on their screen.

> In Europe, banks have to cover frauds

They mostly do in the US, too. This makes consumers less likely to care about security.

> I am against HTTPS everywhere as the only security measure.

No one has advocated that. If you think they have, you have become very confused.

Re: Blink - Intent to deprecate: Insecure usage of powerful features

#92

Post by ldng »

nknighthb wrote: post #91
ldng wrote: post #87

Earlier quoted context omitted.

You're probably right, I am not a security expert and might not be seeing the whole picture. You log into your bank website connected to an open WiFi hotspot ? I never would do that. I think there is a point where you have to apply common sense. I do not care about the downvote, my opinion is what it is and I maintain my position. As I see it (me not been a field expert), HTTPS Everywhere will not save the world. You…

> You log into your bank website connected to an open WiFi hotspot ? I never would do that. Many people do that, and it's quite safe to do so with a modern browser. Were it not, it would not be safe to do so in any context, because man-in-the-middle attacks are possible on any connection, just extra easy on wifi. > I think there is a point where you have to apply common sense. As you are demonstrating quite well here…

> As you are demonstrating quite well here, "common" sense is not good sense. It is stopping you from doing things which are safe, and making you advocate for things which are unsafe.

Now you're misrepresenting what I'm saying. I'm not saying to not use HTTPS when it is needed. I am saying it is not enough. That you argue that HTTPS is mandatory because you want to do your banking on open wifi hotspot baffles me. You should not be doing banking on open WiFi hotspot. PERIOD. I also say putting HTTPS everywhere does not help as much as you think. I am _not_ saying HTTPS is a bad thing. HTTPS is not a substitute for caution.

> You would be typing the URL into the equivalent of a remote desktop session. That is what you're not understanding.

For that to happen the phishing server would have to draw a browser shell (ok, feasable), my list of tabs (still doable) and my "OS" taskbar/menubar, that, is not possible today. I would even argue it would be harder to mimic the 'outsides' of the browser then to present a fake a website. Website change all the time and people don't pay as much attention. Robbers prefer easy targets.

I'm not saying there are not such phising sites but I have yet to see one crafted with such attention to detail (which I think is not possible anyway). Most of those I have seen are not very elaborated. And it does not matter. They feel/look secure enough. HTTPS or not.

>> My bank ask confirmation out of band for every dangerous action (by SMS).

> 1) Most banks do not do that.

> 2) SMS is not a secure channel.

SMS is not a secured channel. True. But it is a _different_ channel and that is the point. Most bank dont do that but they should.

> 3) Banks are not the only target (again, google/gmail accounts are another good example).

Yes, and not connecting to those site on an open WiFi hotspot is still a good practice. Again, HTTPS or not.

Re: Blink - Intent to deprecate: Insecure usage of powerful features

#93

Post by ldng »

icebraining wrote: post #70
ldng wrote: post #65

Earlier quoted context omitted.

1) Expensive for no good reason for 80% of sites out there 2) We agree it is useful in some case. That what makes it hard to go against, because it seems a reasonable objective. The problem is where do you put the limit. I don't "fullscreen" my bank account. To me, forbidding fullscreen on HTTP is quite over the top but fits Google agenda of HTTPSing All The Things.

I don't "fullscreen" my bank account. They don't want to prevent you from fullscreening on HTTP. They want to prevent websites from fullscreening your browser on their own accord using the Fullscreen API, which is quite different. HTTPS might be expensive for 80% of the sites, but 80% of sites don't use the Fullscreen API anyway. Frankly, I think people here should read and understand more carefully what the Chrome t…

Google elsewhere, another time, kind of said that they'll be pushing for HTTPS "all-the-thing". It is their agenda. An agenda I do not juge nefarious, just one I disagree with.

That said, I've gone back reread the mail and you're right, I probably jumped the gun a bit here. I did understood "migrate these features to secure-only" as disabling those features on non-HTTPS at mid/long term.

I think HTTPS "all-the-thing" trend is not necessarily a good thing. It is not _always_ needed, it can had complexity, it has a cost a it leads to an over simplification of security in general. It is a trend that annoys me a bit and I sometimes overreact about it.

Note that I distinguish HTTPS "all-the-thing" from HTTPS "when and where it is needed" for security concerns.

Re: Blink - Intent to deprecate: Insecure usage of powerful features

#94

Post by runeks »

protomyth wrote: post #90
Eridrus wrote: post #86

Earlier quoted context omitted.

Nothing currently stops paypall.com getting a certificate and the technology is not meant to do that. EV-SSL is kind of meant to deal with that if you want to pay the fees. But this seems more in line with a movement towards HTTPS by default and marking HTTP as insecure.

I'm pretty sure the certificate companies when doing their verification stop obvious attempts at scams. So, all this is to get an encrypted connection?

> So, all this is to get an encrypted connection?

This strikes me as odd too.

What's the difference between an automated SSL certificate generator and just having the browser accept self-signed certificates?

openssl is also an automated SSL certificate generator, but it only produces self-signed certificates. So why not just accept self-signed certs?

Re: Blink - Intent to deprecate: Insecure usage of powerful features

#95

Post by johnsoft »

runeks wrote: post #94
protomyth wrote: post #90

Earlier quoted context omitted.

I'm pretty sure the certificate companies when doing their verification stop obvious attempts at scams. So, all this is to get an encrypted connection?

> So, all this is to get an encrypted connection? This strikes me as odd too. What's the difference between an automated SSL certificate generator and just having the browser accept self-signed certificates? openssl is also an automated SSL certificate generator, but it only produces self-signed certificates. So why not just accept self-signed certs?

The difference is in the certificate chain. One of the conditions for being a CA is verifying domain ownership before signing a certificate. In return for this, browsers will trust their cert. As long as a CA keeps this promise, they get to keep their cert and use it to sign certs for others. If they break this promise, their cert will be revoked and browsers will start showing warnings on sites that used them as a CA.

A green padlock indicates this additional level of trust, i.e. authenticity (verified through any method any trusted CA may choose), which a self-signed cert can't provide.

Re: Blink - Intent to deprecate: Insecure usage of powerful features

#96

Post by nknighthb »

ldng wrote: post #92
nknighthb wrote: post #91

Earlier quoted context omitted.

> You log into your bank website connected to an open WiFi hotspot ? I never would do that. Many people do that, and it's quite safe to do so with a modern browser. Were it not, it would not be safe to do so in any context, because man-in-the-middle attacks are possible on any connection, just extra easy on wifi. > I think there is a point where you have to apply common sense. As you are demonstrating quite well here…

> As you are demonstrating quite well here, "common" sense is not good sense. It is stopping you from doing things which are safe, and making you advocate for things which are unsafe. Now you're misrepresenting what I'm saying. I'm not saying to not use HTTPS when it is needed. I am saying it is not enough. That you argue that HTTPS is mandatory because you want to do your banking on open wifi hotspot baffles me. You…

> and my "OS" taskbar/menubar, that, is not possible today

Please articulate why you do not believe that is possible.

> Yes, and not connecting to those site on an open WiFi hotspot is still a good practice. Again, HTTPS or not.

Please articulate why you believe that is good practice.

Don't say "common sense". State the underlying basis of your belief.

And finally, please explain why, even if everything you believe is accurate, it is somehow a negative thing to prevent attacks from being carried out on users who do not share your beliefs and paranoia. Social darwinism?

Actually, one more: Even if no one did any of these things on open wifi, they would still be vulnerable to these attacks, since every internet connection is vulnerable, so please explain why protecting people who do share your beliefs is a bad idea.

Nope, still got another: I travel for work with some frequency, including internationally. When doing so, frequently my only available option is open wifi. Please explain why my livelihood should be destroyed because you, an admitted non-expert, believe using open wifi is a bad idea?

Oh, hey, yet another: Please explain why, even if doing these things were unsafe now, you oppose efforts to make them safe!

Post reply on HN