Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deprecating Non-Secure HTTP

blog.mozilla.org

Post reply on HN
Print view View original

151–160 of 318 posts

Re: Deprecating Non-Secure HTTP

#151

Post by kijin »

Touche wrote: post #128
kijin wrote: post #111

Earlier quoted context omitted.

This is a legitimate concern, but I think the so-called dire consequences are a bit overblown. Major browser vendors like Google and Mozilla don't change their policies in a vacuum while the rest of the world stays static. The move to "deprecate" HTTP is an explicit attempt to manipulate the rest of the world into making SSL easier and more affordable. It is unfair to evaluate this proposal in isolation without consi…

> The move to "deprecate" HTTP is an explicit attempt to manipulate the rest of the world into making SSL easier and more affordable. It is unfair to evaluate this proposal in isolation without considering the market upheaval that it is very much intended to trigger. I'd love to believe this but I've never once seen the https-only nazis bring up this issue on their own, or show any concern for the fact that it will l…

That's just FUD. Nobody is planning to block plain HTTP requests altogether. You can still put up a website on any computer and serve it over plain HTTP, and it will render correctly on most browsers.

The plan is to disable some of the "more dangerous" features when the page is requested over HTTP, in order to entice webmasters to adopt SSL. The list hasn't even been written yet, but I'm guessing that most of those features will be fancy javascript and third-party plugins like Flash. Which you probably shouldn't rely on being enabled in the first place.

I personally wouldn't mind if every insecure page behaved as if I had NoScript & NoFlash enabled by default.

You may be right about the excessive idealism of so-called HTTPS nazis on some online forums, but I'm pretty sure that the people in charge at Google and Mozilla are more level-headed and realistic.

> the goal of this effort is to send a message to the web developer community that they need to be secure

Re: Deprecating Non-Secure HTTP

#152

Post by nitrogen »

unethical_ban wrote: post #32
UnoriginalGuy wrote: post #7

I agree with trying to phase out HTTP, but I think their method is "annoying." What do features have to do with HTTP Vs. HTTPS? It just seems like an arbitrary punishment. Wouldn't it just be significantly easier to simply change the URL art style to make clear that HTTP is "insecure." Like a red broken padlock on every HTTP page? That has the following advantages: - HTTP remains fully working for internal/developmen…

The actions Mozilla proposes sound awful. I believe that a secure (from the NSA) Internet is the way forward. But this seems so goofy to me. There are legitimate reasons for a site not to be hosted on HTTPS. * It is a static site with no forms or logins * It is non-critical info * The site operator can't afford a certificate (Let's Encrypt is only one site...) As you say: Color-code sites with a bit more granularity.…

All browsing behavior can be used to build a profile about someone, whether for advertising, surveillance, or whatever. There's a lot more information in the fact that person A visited pages 1-6 on unencrypted website B than one might realize. This reason alone should be enough for us to demand encryption (not necessarily via CA certificates) for any connection that isn't demonstrably local and unintercepted.

Re: Deprecating Non-Secure HTTP

#153

Post by jfoster »

nosefrog wrote: post #22

I should be happy about this -- who wouldn't want the entire web to be encrypted -- but SSL is so broken for normal people. SSL is expensive (wildcard certificates run $70 a year and up), confusing (how does one pick between the 200 different companies selling certificates?), and incredibly difficult to set up (what order should I cat the certificate pieces in again?). If SSL doesn't change, this move will cut the li…

I anticipate that phasing in SSL everywhere will bring clarity and affordability to SSL.

Clarity, because there will be so much distilled information and tooling around setup.

Affordability, because there will be so much volume that companies will start to compete on price in the same way that domain companies do.

Re: Deprecating Non-Secure HTTP

#154

Post by Touche »

wampus wrote: post #149
Touche wrote: post #128

Earlier quoted context omitted.

> The move to "deprecate" HTTP is an explicit attempt to manipulate the rest of the world into making SSL easier and more affordable. It is unfair to evaluate this proposal in isolation without considering the market upheaval that it is very much intended to trigger. I'd love to believe this but I've never once seen the https-only nazis bring up this issue on their own, or show any concern for the fact that it will l…

The move to deprecate HTTP is solely inspired by the need to authenticate online communication. It's necessary to protect speech on the web, because it makes it harder to tamper with the content in transit. Your ISP shouldn't be able to inject ads into a web page, a WiFi access point shouldn't be able to change every "do" to "do not", and a passive listener shouldn't be able to collect information about you for his o…

We can't have an intelligent conversation if you're going to suggest that free speech doesn't currently, and hasn't always happened on the web.

Re: Deprecating Non-Secure HTTP

#155

Post by carey »

peteretep wrote: post #77
bashinator wrote: post #58

Earlier quoted context omitted.

As an aside, I really don't like wildcard certs. If the private key is compromised, the consequences are so much worse than if you lose a regular cert.

Why is compromise of a cert that can sign " .moo.bar.foo.baz.com" so* much worse than compromise of one that can sign "www.moo.bar.foo.baz.com"?

The compromise of technet.microsoft.com, while a very big deal, would be an order of magnitude worse if it was *.microsoft.com.

Re: Deprecating Non-Secure HTTP

#156

Post by nitrogen »

zaroth wrote: post #145

Mentioned this last time, but since I didn't see it elsewhere in the thread, will mention it again... what about LAN resources served over HTTP like NAS, Printer, AP, etc.? These devices don't have DNS, forget about about SSL. Is the entire local subnet going to be a secure origin like localhost? Because that sounds problematic... What I want is a way to single-click pin a self-signed certificate to "turn it green".

These devices don't have DNS

They should, via mDNS AKA Zeroconf AKA Bonjour AKA Avahi. Often, printer-name.local port 80 or port 631 will lead to the printer's status page.

Re: Deprecating Non-Secure HTTP

#157

Post by Touche »

kijin wrote: post #151
Touche wrote: post #128

Earlier quoted context omitted.

> The move to "deprecate" HTTP is an explicit attempt to manipulate the rest of the world into making SSL easier and more affordable. It is unfair to evaluate this proposal in isolation without considering the market upheaval that it is very much intended to trigger. I'd love to believe this but I've never once seen the https-only nazis bring up this issue on their own, or show any concern for the fact that it will l…

That's just FUD. Nobody is planning to block plain HTTP requests altogether. You can still put up a website on any computer and serve it over plain HTTP, and it will render correctly on most browsers. The plan is to disable some of the "more dangerous" features when the page is requested over HTTP, in order to entice webmasters to adopt SSL. The list hasn't even been written yet, but I'm guessing that most of those f…

This is not true. The suggestion is that essentially all new features will require https. You are effectively blocking http if I can't do anything interesting with it.

Re: Deprecating Non-Secure HTTP

#158

Post by nitrogen »

skybrian wrote: post #31

If things like "python -m SimpleHttpServer" don't work then developers will switch browsers. I don't think anyone is seriously considering what it will take to migrate the long tail of development tools that use HTTP on localhost.

Has Mozilla indicated whether HTTP2 connections with opportunistic encryption will get access to secure-site features? If so, then SimpleHttpServer could be updated to use HTTP2+oe.

Re: Deprecating Non-Secure HTTP

#159

Post by Touche »

oldmanjay wrote: post #147
Touche wrote: post #128

Earlier quoted context omitted.

> The move to "deprecate" HTTP is an explicit attempt to manipulate the rest of the world into making SSL easier and more affordable. It is unfair to evaluate this proposal in isolation without considering the market upheaval that it is very much intended to trigger. I'd love to believe this but I've never once seen the https-only nazis bring up this issue on their own, or show any concern for the fact that it will l…

I'm not convinced that's the backbone of the web at all. Can you back up your assertion with anything beyond emotional pleading?

There were alternatives like AOL and Prodigy and the open web killed them.

Re: Deprecating Non-Secure HTTP

#160

Post by WallWextra »

kazinator wrote: post #47

This is stupid. There are all kinds of use cases where you don't care who knows what you're looking at, or whether it is authentic. Say I navigate to some restaurant's web page using HTTP. Even if I used HTTPS, someone spying on my traffic would know what I'm reading, if the IP address is a dedicated server for that web site only. Whether I use HTTP or HTTPS, they could infer that I'm interested in visiting the resta…

To be fair, keeping advanced browser features out of the hands of restaurant websites sounds like a good thing.
Post reply on HN