If anyone needs help or has questions about SSL, please ask! I work at a company that provides SSL and would also be happy to give out discounts to anyone here.
Deprecating Non-Secure HTTP
101–110 of 318 posts
Re: Deprecating Non-Secure HTTP
#102I agree with trying to phase out HTTP, but I think their method is "annoying." What do features have to do with HTTP Vs. HTTPS? It just seems like an arbitrary punishment. Wouldn't it just be significantly easier to simply change the URL art style to make clear that HTTP is "insecure." Like a red broken padlock on every HTTP page? That has the following advantages: - HTTP remains fully working for internal/developmen…
I can imagine a lot of personal sites will suffer from this. With most, they're sitting on something like Eleven2 or Dreamhost, who requires a dedicated IP for an SSL certificate, which the user then has to buy and figure out for himself (it's not trivial for the average "webmaster"), or buy the certificate from their host which is marked-up plenty. Yes, the hosts could wildcard. Yes, there are other solutions out th…
I think you're overstating how bad things are. Dreamhost, for example, no longer requires a dedicated IP for SSL, though they do still recommend it for e-commerce. They are charging $15/year for a CA-signed certificate. Granted, that's for a single-site cert and they don't support wildcards under this scenario, but the vacation blogger isn't likely to need that anyway.
Re: Deprecating Non-Secure HTTP
#103Hopefully they will also introduce a standard and free way to get SSL certificates. I do not like the idea of having to buy new certificates every year (and all the hassle that comes with installing the certificates) just to maintain a very basic website.
Nope. The goal is to make running a server only available to corporate entities. It reduce competition from folks like yourself.
What in your life must have happened for you to actually believe such nonsense? Or do you have a financial incentive of sorts to try to make other people believe it?
Re: Deprecating Non-Secure HTTP
#104I envy you, citizens of the free world :) You (mostly) can use HTTPS, avoid government surveillance, and use new shiny Mozilla features (for whatever they are going to be). It's not the same in e.g. Russia (and I'm sure it's not just Russia). In Russia, the Web is now officially being censored by the state. They have a national register of prohibited resources -- basically, a huge list of URLs. Every ISP must block a…
> then ISPs have no other choice but to block all traffic > to your site entirely. Given that choice, many > webmasters (myself included) will have to choose plain > HTTP At some point, blocking CDNs at IP level becomes too much of an economic burden on a country to be feasible. We've seen an unwillingness by the Chinese to block access to GitHub; presumably this means Fastly (their CDN provider) is safe for a while.
Did you know that Russians had github blocked for several days? Anyway, you're talking about counter-censorship warfare. Yes, some of those measures will be somewhat effective sometimes, but the costs (not necessarily even monetary) are actually quite substantial, and it's definitely not for everyone.
Re: Deprecating Non-Secure HTTP
#105I have to say, I actually disagree with this move. While I think the intentions sound noble, and I'm all for a more secure web, I also believe that a web browser has no business dictating that the entire web should be forced in HTTPs. I don't see any benefit in this type of blanket, all or nothing, type of approach. In fact, I see it doing more damage than good. Encrypting blogs, news websites, etc still makes no sen…
You're oversimplifying and being dismissive without cause.
>a web browser has no business dictating that the entire web should be forced in HTTPs.
1. that isn't what is happening as per the article. They are going to begin picking features that shouldn't be allowed over HTTP (like, say, geo location, web camera access, etc).
2. a browser is precisely the actor that should push for these things. If not browser vendors, who?
>What is forcing HTTPS on the entire web actually doing?
Encrypting streams of data that were previously unencrypted.
>Who is it benefiting?
Users.
>The government can still snoop your data in-flight.
So your argument is 'this isn't perfect for all attack vectors, so it isn't useful at all'?
>Do we need TLS to read the latest TMZ post about Miley Cyrus?
Yes. See how easy that is?
Re: Deprecating Non-Secure HTTP
#106I should be happy about this -- who wouldn't want the entire web to be encrypted -- but SSL is so broken for normal people. SSL is expensive (wildcard certificates run $70 a year and up), confusing (how does one pick between the 200 different companies selling certificates?), and incredibly difficult to set up (what order should I cat the certificate pieces in again?). If SSL doesn't change, this move will cut the li…
Why this project: https://letsencrypt.org/ is so important. From the site: Let’s Encrypt is a new Certificate Authority: It’s free, automated, and open. Arriving Mid-2015
And what if I don't trust any of the "MAJOR SPONSORS".
Re: Deprecating Non-Secure HTTP
#107If you really want to tackle SSL make it less stupid. Self-signed certificates? I want these pinned and treated as secure. I want a notification if they change around the time they expire and a really big warning if they don't.
If we must have central trust sources, then have central hash servers so when I visit a new self-signer I can externally verify the hash.
Re: Deprecating Non-Secure HTTP
#108This is stupid. There are all kinds of use cases where you don't care who knows what you're looking at, or whether it is authentic. Say I navigate to some restaurant's web page using HTTP. Even if I used HTTPS, someone spying on my traffic would know what I'm reading, if the IP address is a dedicated server for that web site only. Whether I use HTTP or HTTPS, they could infer that I'm interested in visiting the resta…
> I suppose that a MITM attack could be perpetrated whereby the attackers rewrite the opening hours.
Or a MITM attack could be perpetrated whereby your computer is -however briefly- part of a JavaScript powered DDOS machine: http://arstechnica.com/security/2015/03/31/massive-denial-of...
Re: Deprecating Non-Secure HTTP
#109This kind of implies that HTTPS is secure. :) I dont think there is anything wrong using HTTP internally in a datacenter for data that is not sensitive (like monitoring, statistics, etc.). I guess you can still access these in legacy mode. I think the title should be that HTTP is getting phased out for public internet use or something.
Re: Deprecating Non-Secure HTTP
#110Great! Now I just need to setup ssl on my Raspberry Pi to access the several web interfaces I have running there. Oh wait. I'm no longer running Firefox, I won't have to worry about this immediately.