Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deprecating Non-Secure HTTP

blog.mozilla.org

Post reply on HN
Print view View original

51–60 of 318 posts

Re: Deprecating Non-Secure HTTP

#51

Post by ikeboy »

UnoriginalGuy wrote: post #7

I agree with trying to phase out HTTP, but I think their method is "annoying." What do features have to do with HTTP Vs. HTTPS? It just seems like an arbitrary punishment. Wouldn't it just be significantly easier to simply change the URL art style to make clear that HTTP is "insecure." Like a red broken padlock on every HTTP page? That has the following advantages: - HTTP remains fully working for internal/developmen…

Allowing some things on http can be a security risk. If you store a cookie, how do I know it's going to the same site next time?

Re: Deprecating Non-Secure HTTP

#52

Post by teraflop »

skybrian wrote: post #31

If things like "python -m SimpleHttpServer" don't work then developers will switch browsers. I don't think anyone is seriously considering what it will take to migrate the long tail of development tools that use HTTP on localhost.

Chrome has been pushing the same thing (deprecating plain-text HTTP and/or visually marking it as non-secure) for quite some time, and they've been very clear that "localhost" will still be considered a secure origin. I don't see any reason to think that Firefox would behave differently.

Re: Deprecating Non-Secure HTTP

#53

Post by bashinator »

tyho wrote: post #34
UnoriginalGuy wrote: post #7

I agree with trying to phase out HTTP, but I think their method is "annoying." What do features have to do with HTTP Vs. HTTPS? It just seems like an arbitrary punishment. Wouldn't it just be significantly easier to simply change the URL art style to make clear that HTTP is "insecure." Like a red broken padlock on every HTTP page? That has the following advantages: - HTTP remains fully working for internal/developmen…

What features have to do with encryption is this. If a browser asks a user "Do you want http://example.com to be able to access your camera", what it is really asking is "Do you want http://example.com , anybody on your local network, state actors, anybody between you and example.com, people who can mess around with BGP and your DNS provider to be able to access your camera?". TLS mostly makes the first question more…

You might explicitly include "employees of the coffee shop/hotel/library providing wifi" in the list of actors who can intercept your traffic. Honestly, I think that one will get the most attention of the average person.

Re: Deprecating Non-Secure HTTP

#54

Post by adventured »

im3w1l wrote: post #30
natrius wrote: post #17

Earlier quoted context omitted.

If the cost of an SSL certificate is a barrier for you to compete, you should probably do something else.

It just takes a tiny cost to turn off bright 10 year olds from experimenting.

Cloudflare's free plan has SSL now, which a 10 year could utilize. While that opens up a potential MITM attack, I don't believe it's worse than having no SSL at all (others argue it is, on the premise that it creates a false sense of security).

Re: Deprecating Non-Secure HTTP

#55

Post by nosefrog »

adventured wrote: post #37
joelrunyon wrote: post #23

Earlier quoted context omitted.

Seriously, SSLs basically 2x the hosting cost for low end hosting packages. Not great for people running small websites.

SSL should be a universally available free resource. I expect that it will be in the near future. That said, it is still very cheap for small sites too: $9 - $11 / year for perfectly good certs. Less than $1 per month is a small burden. https://www.namecheap.com/security/ssl-certificates/domain-v...

I understand what you're saying, requiring SSL doesn't seem like too much of a burden superficially. But it's magnitudes harder and more frustration inducing than simply buying a domain. My website is protected by the cheapest certificate on that list, and it was a gigantic pain to set up. Also, only the root subdomain on my site is protected -- I have things on other subdomains which I can't encrypt because $10 dollars a year quickly adds up.

Re: Deprecating Non-Secure HTTP

#56

Post by cdnsteve »

I have to say, I actually disagree with this move. While I think the intentions sound noble, and I'm all for a more secure web, I also believe that a web browser has no business dictating that the entire web should be forced in HTTPs.

I don't see any benefit in this type of blanket, all or nothing, type of approach. In fact, I see it doing more damage than good. Encrypting blogs, news websites, etc still makes no sense to me. I'm actually disappointed in Mozilla for looking at doing this. As a developer I respect many of their products and see them as champions of the web in a lot of ways.

HTTPs does not:

- protect a user from malware on their own system with keylogging taking place

- increase security in outdated and insecure websites (eg: old known exploitable code)

- prevent any browser drive-by downloaders or exploits

- increase the security of the web server itself (web stack thats serving requests) - yeah that's you using a private VPS without doing Kernel updates.

These are likely the major factors of why people have security issues. What is forcing HTTPS on the entire web actually doing? Who is it benefiting? The government can still snoop your data in-flight. If someone is connected to a fake wifi endpoint there is on the fly SSL decryption out there.....

Do we still need TLS for actual secure transactions that deal with personal data? Yes, of course. That's what it is intended for.

Do we need TLS to read the latest TMZ post about Miley Cyrus? You decide... (oh and it's http if you were wondering)

Re: Deprecating Non-Secure HTTP

#57

Post by finnn »

UnoriginalGuy wrote: post #7

I agree with trying to phase out HTTP, but I think their method is "annoying." What do features have to do with HTTP Vs. HTTPS? It just seems like an arbitrary punishment. Wouldn't it just be significantly easier to simply change the URL art style to make clear that HTTP is "insecure." Like a red broken padlock on every HTTP page? That has the following advantages: - HTTP remains fully working for internal/developmen…

I was thinking that was the way to go too for a while, but then I realized that marking http as insecure will just get user used to clicking through security warnings and assuming that they're "normal"

Re: Deprecating Non-Secure HTTP

#58

Post by bashinator »

nosefrog wrote: post #22

I should be happy about this -- who wouldn't want the entire web to be encrypted -- but SSL is so broken for normal people. SSL is expensive (wildcard certificates run $70 a year and up), confusing (how does one pick between the 200 different companies selling certificates?), and incredibly difficult to set up (what order should I cat the certificate pieces in again?). If SSL doesn't change, this move will cut the li…

As an aside, I really don't like wildcard certs. If the private key is compromised, the consequences are so much worse than if you lose a regular cert.

Re: Deprecating Non-Secure HTTP

#59

Post by teraflop »

Navarr wrote: post #21
JeremyBanks wrote: post #15

Earlier quoted context omitted.

https://letsencrypt.org/

which will be great when it finally exists

Despite comments elsewhere in this thread that "the web moves fast", browser changes typically involve very slow, deliberate, careful rollout plans, even for much smaller compatibility issues than this one.

I'm sure the Firefox team (and Chrome, which is pushing in the same direction) will be keeping a close eye on the progress of Let's Encrypt, and using it to set the timeframe for their proposed changes.

(Not to mention that Mozilla is a major sponsor of Let's Encrypt, so it's reasonable to expect a high degree of coordination.)

Re: Deprecating Non-Secure HTTP

#60

Post by finnn »

nosefrog wrote: post #22

I should be happy about this -- who wouldn't want the entire web to be encrypted -- but SSL is so broken for normal people. SSL is expensive (wildcard certificates run $70 a year and up), confusing (how does one pick between the 200 different companies selling certificates?), and incredibly difficult to set up (what order should I cat the certificate pieces in again?). If SSL doesn't change, this move will cut the li…

$70 for a wildcard cert!? Where are you looking at? There's a shitload of AlphaSSL resellers that are much cheaper. I got 2 wildcard certs for $20/yr. Of course, there's really no need for a wildcard certificate, and StartCom gives out free, valid non-wildcard certs right now. On top of that, Lets Encrypt should simplify the process greatly.
Post reply on HN