Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deprecating Non-Secure HTTP

blog.mozilla.org

Post reply on HN
Print view View original

251–260 of 318 posts

Re: Deprecating Non-Secure HTTP

#251

Post by scrollaway »

pckspcks wrote: post #243
scrollaway wrote: post #103

Earlier quoted context omitted.

What in your life must have happened for you to actually believe such nonsense? Or do you have a financial incentive of sorts to try to make other people believe it?

Well, in this case: 1. The technical solution is trivial. You always have encryption, but http=self-signed cert, and no authentication, and no lock icon. https=CA cert, encryption, authentication, and lock icon. 2. There are strong government and corporate interests in being able to filter the open web. This closes the open web. 3. For the first time in my life, I have a comment on Hacker News or Reddit at -4. I've p…

I fully agree with #1, but how do you go from a currently-imperfect solution (which could be improved over the years, moving towards a self-signed cert default solution which by the way we are looking at in http/2) to "the goal is to reduce competition"?

Mozilla is one of the most consumer-friendly companies in the world, and all I can see is you trying to undermine their efforts. Are there issues with the current state of affairs? Sure. Are they at fault?

You've been downvoted because your comment reeks of gratuitous negativity, not because a debate is not welcome.

Re: Deprecating Non-Secure HTTP

#252

Post by rhizome31 »

bigiain wrote: post #230
joosters wrote: post #205

Earlier quoted context omitted.

StartSSL is far from simple to use.

It's hardly rocket surgery though. Anyone incapable of following the steps required there is probably not who you'd want implementing your web server security…

Last time I tried, their site had JavaScript bugs and their email validation procedure didn't pass greylisting. I didn't want to place my web server security in the hands of a company with such low quality standards.

Re: Deprecating Non-Secure HTTP

#253

Post by xorcist »

indymike wrote: post #239
xorcist wrote: post #214

Earlier quoted context omitted.

That's a bit silly, considering it was developed over a ten year process, and a lot of security professionals had a hand in its design. There are problems with it, which some people are quick to point out, and it is important to be aware of them. The fact that your DNS data is enumerable is an important change, for example. You could compare it to IPsec, which is what most VPNs use, which is comparable in security an…

If experts take 10 years to make a product that sucks, the product still sucks.

Absolutely. SSH also sucks. TLS sucks badly. The only protocols that doesn't are those that haven't seen real-world usage yet. That's what drives innovation.

Re: Deprecating Non-Secure HTTP

#254

Post by detaro »

pornel wrote: post #242
detaro wrote: post #238

Earlier quoted context omitted.

Free as long as you never have to revoke them. Which means people primarily looking at costs are actually incentived to not revoke compromised certs.

Which is still waaaay better if they ran HTTP.

I don't agree. False pretense of security can be worse than visible insecurity.

Re: Deprecating Non-Secure HTTP

#255

Post by dukky »

teraflop wrote: post #81
cdnsteve wrote: post #56

I have to say, I actually disagree with this move. While I think the intentions sound noble, and I'm all for a more secure web, I also believe that a web browser has no business dictating that the entire web should be forced in HTTPs. I don't see any benefit in this type of blanket, all or nothing, type of approach. In fact, I see it doing more damage than good. Encrypting blogs, news websites, etc still makes no sen…

HTTPS provides authentication, not just confidentiality. When you visit "blogs, news websites, etc" do you think there's no value in being able to know for sure that the content is exactly what the owner of the site intended? Even though ISPs have proven themselves willing to intercept and modify that content in transit? http://arstechnica.com/tech-policy/2013/04/07/how-a-banner-a... http://arstechnica.com/tech-polic…

But https doesn't 'let you know for sure that the content is exactly what the owner of the site intended' as it doesn't protect you from xss

Re: Deprecating Non-Secure HTTP

#257

Post by cJ0th »

I can see how https is technically better than http. But wouldn't a https-only web put too much trust in companies who create certificates? I can't think of a concrete danger but it sounds dangerous that the degree of security depends on monetary interests.

Re: Deprecating Non-Secure HTTP

#258

Post by nailer »

thwarted wrote: post #228
nothrabannosir wrote: post #38

Earlier quoted context omitted.

That's just one project, and it doesn't even exist yet. The web is moving faster every day, apparently. I sure do hope that project will be all it's chalked up to be. For example, I need IP-only certs for a new project I'm working on (waiting for DNS to propagate to all clients is too unreliable and slow). If letsencrypt doesn't do that... well then I'd have to hope real hard for a competent CA out there who has an a…

For example, I need IP-only certs for a new project I'm working on (waiting for DNS to propagate to all clients is too unreliable and slow). This doesn't make any sense. You're not waiting for DNS to propagate to clients; if anything you're waiting for recursive DNS servers at shitty ISPs to time out their caches when they are configured to not honor the RR's TTL sent by the authoritative server in a misguided attemp…

How often are DNS caches configured to ignore TTLs? That sounds awful.

I assumed the grandparent simply didn't understand the need to lower his TTLs.

Re: Deprecating Non-Secure HTTP

#259

Post by [deleted] »

mahouse wrote: post #240
PhasmaFelis wrote: post #224

Earlier quoted context omitted.

I just spent several minutes googling for "EFF" in conjunction with "feminism" and didn't find anything that appeared to be relevant. I did the same for Rob Graham, and he apparently doesn't like the EFF, but I haven't found the EFF saying anything about him yet. I'm sure someone associated with the EFF has mentioned these things at some point, but they don't appear to be major issues. Could you give me some links?

Feminism: most of their staff are feminists. I'm not going to spend my time googling and posting links. Here's a start https://www.eff.org/about/staff Rob Graham was called out in this article which was subsequently edited: https://twitter.com/ErrataRob/status/553716844650307584 Also, they lie constantly, in lousy attempts of populism and being lavished with attention: http://blog.erratasec.com/2014/07/eff-lies-about…

[deleted]

Re: Deprecating Non-Secure HTTP

#260

Post by hackmiester »

hobarrera wrote: post #235
recursive wrote: post #179

Earlier quoted context omitted.

I'm a person who actually deploys .net apps to internal IIS QA servers. If I want them to use HTTPS, I have to configure it. I don't know anything about my own CA certificates. I'm not saying it couldn't happen, but it's certainly easier to suggest just not using firefox if something isn't working.

So you handle deployment of apps inside a corporate network, and have no idea on how to manage you own CA? How does you corporation handle actually important corporate sites that nobody must access? It sound to my like your corp has some issues on this side.

...Why would a company need to run their own CA to do this?
Post reply on HN