Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deprecating Non-Secure HTTP

blog.mozilla.org

Post reply on HN
Print view View original

221–230 of 318 posts

Re: Deprecating Non-Secure HTTP

#221

Post by [deleted] »

Touche wrote: post #154
wampus wrote: post #149

Earlier quoted context omitted.

The move to deprecate HTTP is solely inspired by the need to authenticate online communication. It's necessary to protect speech on the web, because it makes it harder to tamper with the content in transit. Your ISP shouldn't be able to inject ads into a web page, a WiFi access point shouldn't be able to change every "do" to "do not", and a passive listener shouldn't be able to collect information about you for his o…

We can't have an intelligent conversation if you're going to suggest that free speech doesn't currently, and hasn't always happened on the web.

[deleted]

Re: Deprecating Non-Secure HTTP

#222

Post by jamespo »

scrollaway wrote: post #216
kazinator wrote: post #47

This is stupid. There are all kinds of use cases where you don't care who knows what you're looking at, or whether it is authentic. Say I navigate to some restaurant's web page using HTTP. Even if I used HTTPS, someone spying on my traffic would know what I'm reading, if the IP address is a dedicated server for that web site only. Whether I use HTTP or HTTPS, they could infer that I'm interested in visiting the resta…

It has become so tiresome to deal with the likes of you - people who will say how they don't need or want SSL, how they don't care about privacy. This is the techie version of "nothing to hide, nothing to fear". It's a pathetic argument and brings nothing to the table. Just because you don't care about the NSA knowing you like McDonalds when you browse their menu, everybody else in the world shouldn't care about thei…

A shame that's not the argument at all - what is being argued against is the chipping away of HTTP, not implementation of HTTPS.

Re: Deprecating Non-Secure HTTP

#223

Post by merrua »

pdkl95 wrote: post #204
joelrunyon wrote: post #23

Earlier quoted context omitted.

Seriously, SSLs basically 2x the hosting cost for low end hosting packages. Not great for people running small websites.

That is today's prices, based past demand. As demand for SSL hosting goes up, gradually replacing plaintext hosting, the price will come down. I actually expect the price of plaintext HTTP hosting to go up a bit; partly due to reduced demand, but also due to increased risk/liability. With SSL being the "industry best practice", I expect at least a few bean counters will view the risk of private information leaks or h…

Demand going up does not always mean that pricing goes down. Especially when supply is limited

Re: Deprecating Non-Secure HTTP

#224

Post by PhasmaFelis »

mahouse wrote: post #211
PhasmaFelis wrote: post #180

Earlier quoted context omitted.

Which specific EFF policies/goals are you opposed to?

Off the top of my head: the bashing of Rob Graham, the defense of concepts that have nothing to do with our rights on the Internet, such as feminism.

I just spent several minutes googling for "EFF" in conjunction with "feminism" and didn't find anything that appeared to be relevant. I did the same for Rob Graham, and he apparently doesn't like the EFF, but I haven't found the EFF saying anything about him yet. I'm sure someone associated with the EFF has mentioned these things at some point, but they don't appear to be major issues. Could you give me some links?

Re: Deprecating Non-Secure HTTP

#226

Post by _ak »

bigdubs wrote: post #24
nosefrog wrote: post #22

I should be happy about this -- who wouldn't want the entire web to be encrypted -- but SSL is so broken for normal people. SSL is expensive (wildcard certificates run $70 a year and up), confusing (how does one pick between the 200 different companies selling certificates?), and incredibly difficult to set up (what order should I cat the certificate pieces in again?). If SSL doesn't change, this move will cut the li…

Why this project: https://letsencrypt.org/ is so important. From the site: Let’s Encrypt is a new Certificate Authority: It’s free, automated, and open. Arriving Mid-2015

Wake me again when this is more than vaporware.

Re: Deprecating Non-Secure HTTP

#227

Post by [deleted] »

nothrabannosir wrote: post #38
bigdubs wrote: post #24

Earlier quoted context omitted.

Why this project: https://letsencrypt.org/ is so important. From the site: Let’s Encrypt is a new Certificate Authority: It’s free, automated, and open. Arriving Mid-2015

That's just one project, and it doesn't even exist yet. The web is moving faster every day, apparently. I sure do hope that project will be all it's chalked up to be. For example, I need IP-only certs for a new project I'm working on (waiting for DNS to propagate to all clients is too unreliable and slow). If letsencrypt doesn't do that... well then I'd have to hope real hard for a competent CA out there who has an a…

[deleted]

Re: Deprecating Non-Secure HTTP

#228

Post by thwarted »

nothrabannosir wrote: post #38
bigdubs wrote: post #24

Earlier quoted context omitted.

Why this project: https://letsencrypt.org/ is so important. From the site: Let’s Encrypt is a new Certificate Authority: It’s free, automated, and open. Arriving Mid-2015

That's just one project, and it doesn't even exist yet. The web is moving faster every day, apparently. I sure do hope that project will be all it's chalked up to be. For example, I need IP-only certs for a new project I'm working on (waiting for DNS to propagate to all clients is too unreliable and slow). If letsencrypt doesn't do that... well then I'd have to hope real hard for a competent CA out there who has an a…

For example, I need IP-only certs for a new project I'm working on (waiting for DNS to propagate to all clients is too unreliable and slow).

This doesn't make any sense. You're not waiting for DNS to propagate to clients; if anything you're waiting for recursive DNS servers at shitty ISPs to time out their caches when they are configured to not honor the RR's TTL sent by the authoritative server in a misguided attempt to make the internet "faster".

But this is completely avoidable without having to use IPs or certificates with CN/SAN that are IPs: get a wildcard cert and rotate the subdomain name. It's a new hostname, so it busts intermediate DNS caches by being new queries; since it's a new query, there's no "propagation to clients" to wait for when you change IPs, all queries for the new name hit authoritative servers. Additionally, it looks infinitely more legit than a website that is accessible only via IP address. And doubly additionally, if you're going through so many IPs, presumably you'll be rotating some out and those may be assigned to other people who can then get their own cert for that IP and impersonate you.

Re: Deprecating Non-Secure HTTP

#230

Post by bigiain »

joosters wrote: post #205
bigiain wrote: post #202

Earlier quoted context omitted.

StartSSL exists right now - and has been providing free certs for personal use for years now. I'm curious about your requirement for IP only certs? Sure you don't "own" a domain name, but it's even less true that you "own" a specific IP address. (Well, at least for me, perhaps if your project is in the datacenter/isp/network-infrastructure space you might actually have some cintractual "ownership" of an IP address?)

StartSSL is far from simple to use.

It's hardly rocket surgery though.

Anyone incapable of following the steps required there is probably not who you'd want implementing your web server security…

Post reply on HN