Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deprecating Non-Secure HTTP

blog.mozilla.org

Post reply on HN
Print view View original

61–70 of 318 posts

Re: Deprecating Non-Secure HTTP

#61

Post by multinglets »

Oh cool, so with increasingly stringent SSL requirements, we're basically entirely phasing out the ability to run a website without a certificate authority's involvement.

So instead of all this bullshit from Chrome, Firefox, et al., can I please just send some huge check to GoDaddy or Verisign or whomever and continue to use the internet as an open platform and not some managed service where we try to hold everyone's hand because we've conditioned them to spew their personal information all over the web all day?

Re: Deprecating Non-Secure HTTP

#62

Post by deftnerd »

bigdubs wrote: post #24
nosefrog wrote: post #22

I should be happy about this -- who wouldn't want the entire web to be encrypted -- but SSL is so broken for normal people. SSL is expensive (wildcard certificates run $70 a year and up), confusing (how does one pick between the 200 different companies selling certificates?), and incredibly difficult to set up (what order should I cat the certificate pieces in again?). If SSL doesn't change, this move will cut the li…

Why this project: https://letsencrypt.org/ is so important. From the site: Let’s Encrypt is a new Certificate Authority: It’s free, automated, and open. Arriving Mid-2015

You can also get a certificate with as many as 100 domains in the SAN for free from https://buy.wosign.com/free/FreeSSL.html

Re: Deprecating Non-Secure HTTP

#63

Post by undefined0 »

nothrabannosir wrote: post #38
bigdubs wrote: post #24

Earlier quoted context omitted.

Why this project: https://letsencrypt.org/ is so important. From the site: Let’s Encrypt is a new Certificate Authority: It’s free, automated, and open. Arriving Mid-2015

That's just one project, and it doesn't even exist yet. The web is moving faster every day, apparently. I sure do hope that project will be all it's chalked up to be. For example, I need IP-only certs for a new project I'm working on (waiting for DNS to propagate to all clients is too unreliable and slow). If letsencrypt doesn't do that... well then I'd have to hope real hard for a competent CA out there who has an a…

LetsEncrypt works with IPv4. I assume it will work with IPv6. LetsEncrypt is a Mozilla project, it's safe to assume they will launch LetsEncrypt before deprecating non-secure websites.

Re: Deprecating Non-Secure HTTP

#64

Post by teraflop »

jamiesonbecker wrote: post #49

This potentially removes the relative anonymity that the entire non-commercial web offers (and in fact was largely built on, post-DARPA). Free DV certificates may help minimize that negative effect, but this entire scheme still further increases reliance on a badly broken CA system. This seems like a somewhat rushed idea with good intentions but without sufficient community discussion.. rather than put all our eggs i…

> are there things we can do right now in terms of favoring self-authentication of self-signed certs?

That's a good question, but I've yet to see any justification for thinking the answer is "yes".

If an attacker controls your network connection and/or DNS, what possible information could you obtain to prove the authenticity of a website, without reference to an external source of authority?

Re: Deprecating Non-Secure HTTP

#65

Post by KeytarHero »

Can someone explain why HTTPS is necessary for a webpage where I don't log in or submit any information?

For example, take the xkcd homepage. Not only do I not log into it, there's nowhere I _could_ log in. The only input is a search box (which seems to be disabled at the moment anyway). Is it really a security risk if my communication with xkcd's servers is unencrypted? (Yes, xkcd has a store and a forum, and I understand why you'd need HTTPS on those subdomains - but I don't see why the main domain needs it.)

I agree with the parts of their plan to disable browser features that could be a security risk to non-HTTPS pages - that makes total sense. But it seems absurd to prevent static pages from using future CSS layout features just because they're not using HTTPS.

Re: Deprecating Non-Secure HTTP

#66

Post by vonklaus »

At first, I was apprehensive. As a newer web developer I have never had a secure site. I have a small portfolio and a few tiny side projects I work on, nothing with >10 users. I will have to learn more, do more, and pay more to support HTTPS.

When I look at it from a different lens, I believe the internet should be as private as possible. Encryption is a solution. I think we should all make a push to make things more secure. Hopefully, we can destroy the cottage industry around SSL certs and it will be bundled in as an expected value add with either hosting or DNS purchase. I think that $1 a month is enough rent for a cert, I saw an SSL cert offered for $600 bucks which is quite problematic if it represented the threshold someone would have to cross to get a cert.

Hopefully, mozilla will work to sort out the CA problem, which is the real thing holding back HTTPS adoption.

Re: Deprecating Non-Secure HTTP

#67

Post by nakovet »

From the comments section:

> Not all data needs to be secure. Not all websites need to be secure. Requiring HTTPS means additional compute and additional servers securing something may not need to be secured and provides no benefit – only cost. Free and open information should be (optionally) free of encryption as well.

Indeed, there still a portion of the internet that could benefit from being SSL free.

Re: Deprecating Non-Secure HTTP

#68

Post by nosefrog »

finnn wrote: post #60
nosefrog wrote: post #22

I should be happy about this -- who wouldn't want the entire web to be encrypted -- but SSL is so broken for normal people. SSL is expensive (wildcard certificates run $70 a year and up), confusing (how does one pick between the 200 different companies selling certificates?), and incredibly difficult to set up (what order should I cat the certificate pieces in again?). If SSL doesn't change, this move will cut the li…

$70 for a wildcard cert!? Where are you looking at? There's a shitload of AlphaSSL resellers that are much cheaper. I got 2 wildcard certs for $20/yr. Of course, there's really no need for a wildcard certificate, and StartCom gives out free, valid non-wildcard certs right now . On top of that, Lets Encrypt should simplify the process greatly.

https://www.google.com/search?q=ssl+wildcard+certificate+che...

I can't find anything lower than $60.

Re: Deprecating Non-Secure HTTP

#70

Post by rogerbinns »

KeytarHero wrote: post #65

Can someone explain why HTTPS is necessary for a webpage where I don't log in or submit any information? For example, take the xkcd homepage. Not only do I not log into it, there's nowhere I _could_ log in. The only input is a search box (which seems to be disabled at the moment anyway). Is it really a security risk if my communication with xkcd's servers is unencrypted? (Yes, xkcd has a store and a forum, and I unde…

Intermediaries can (and already do) silently cause the content to be tracked, altered or otherwise modified against both your and the site owner's interests.

How would you feel if they inserted javascript to mine bitcoins?

Post reply on HN