Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Switch to HTTPS Now, For Free

konklone.com

Post reply on HN
Print view View original

101–110 of 264 posts

Re: Switch to HTTPS Now, For Free

#101

Post by chc »

espeed wrote: post #90
konklone wrote: post #65

Earlier quoted context omitted.

SSL Labs does a great job of SSL testing domains and making recommendations: https://www.ssllabs.com/ssltest/analyze.html?d=konklone.com I developed my nginx config based on their recommendations: https://gist.github.com/konklone/6532544

Instead of using nginx or a Web server for SSL, you might consider using something like stunnel for SSL termination as recommended by 'cperciva: "...for security reasons, I prefer to keep SSL termination separate from HTTP serving" ( http://colin.percival.usesthis.com , http://www.daemonology.net/blog/2009-09-28-securing-https.ht... ). In his 2010 talk "Everything you need to know about cryptography in 1 hour" ( http…

> In his 2010 talk "Everything you need to know about cryptography in 1 hour" (http://blip.tv/fosslc/everything-you-need-to-know-about-cryp...), Colin also recommends limiting SSL use to a confined area.

Doesn't this leave you vulnerable to session theft?

Re: Switch to HTTPS Now, For Free

#102

Post by zmmmmm »

Do people trust StartCom? Just curious ... I always wondered why you have all these very expensive cert providers who charge a lot for SSL certs, and then this mysterious company with ties to Israel is handing them out for free?

I know it's pure paranoia, but this would seem to be an excellent way to compromise a lot of SSL traffic if you were into that, and the Israelis are pretty famous for all kinds of spying activity that makes PRISM look tame. Just curious what others think about this?

Re: Switch to HTTPS Now, For Free

#103

Post by lem72 »

zmmmmm wrote: post #102

Do people trust StartCom? Just curious ... I always wondered why you have all these very expensive cert providers who charge a lot for SSL certs, and then this mysterious company with ties to Israel is handing them out for free? I know it's pure paranoia, but this would seem to be an excellent way to compromise a lot of SSL traffic if you were into that, and the Israelis are pretty famous for all kinds of spying acti…

This is my thoughts exactly.... Cue Conspiracy Theory

Re: Switch to HTTPS Now, For Free

#104

Post by gsnedders »

zmmmmm wrote: post #102

Do people trust StartCom? Just curious ... I always wondered why you have all these very expensive cert providers who charge a lot for SSL certs, and then this mysterious company with ties to Israel is handing them out for free? I know it's pure paranoia, but this would seem to be an excellent way to compromise a lot of SSL traffic if you were into that, and the Israelis are pretty famous for all kinds of spying acti…

And how do they guarantee identity for zero cost to them? To actually meet all the CA requirements to be a default trusted root isn't easy.

Re: Switch to HTTPS Now, For Free

#105

Post by lwf »

zmmmmm wrote: post #102

Do people trust StartCom? Just curious ... I always wondered why you have all these very expensive cert providers who charge a lot for SSL certs, and then this mysterious company with ties to Israel is handing them out for free? I know it's pure paranoia, but this would seem to be an excellent way to compromise a lot of SSL traffic if you were into that, and the Israelis are pretty famous for all kinds of spying acti…

With StartCom, you just send them a CSR and they sign it. They don't get access to your key.

StartCom passed an outside audit and is included in most modern browsers by default, indicating that they at least trust StartCom.

They charge for the work they have to do. So, EV and identity validation cost money. Most "domain validated" certs are basically no work, as you can see from the incredibly cheap prices other SSL vendors offer them at.

Re: Switch to HTTPS Now, For Free

#106

Post by zobzu »

zmmmmm wrote: post #102

Do people trust StartCom? Just curious ... I always wondered why you have all these very expensive cert providers who charge a lot for SSL certs, and then this mysterious company with ties to Israel is handing them out for free? I know it's pure paranoia, but this would seem to be an excellent way to compromise a lot of SSL traffic if you were into that, and the Israelis are pretty famous for all kinds of spying acti…

making certs doesn't take money. verifying you own the domain (lowest level cert) doesnt take money. all this is fully automated, everywhere. Being an SSL provider is a juicy business once you get things rolling.

Now then again, it dosn't matter if you trust them or not, because your browser trust them for you. using another provider will not make you have a better trust in the sites you browse. Any of the providers can compromise everyone elses trust, as long as they're trusted by the browser.

And thats why the current SSL trust scheme sucks, by the way.

Re: Switch to HTTPS Now, For Free

#107

Post by valtron »

dragonwriter wrote: post #99
valtron wrote: post #93

As I understand it, (correct me if I'm wrong), https has two parts: 1. Encryption: protects from eavesdropping (e.g. your internet provider can't see what you're communicating) 2. Authentication: protects from MITM (e.g. someone changing the data en-route) For full security you need both; but #2 is much more complicated than #1 because it needs a trusted third party, certificates, etc. It's effectively a barrier to h…

You can't have protection from eavesdropping without protection from MITM, because MITM can be used for eavesdropping (as well as actually inserting malicious traffic into the communication.) Which is why encryption without authentication is pointless (or, worse, illusory security) in most cases. On the internet, your communication is inherently being handed off through a number of intermediaries to an endpoint. If y…

Still, having #1 is still better than neither. Instead of the NSA (sorry for beating a dead horse) simply siphoning your plaintext off the wire, isn't it more secure if you force them to have to actively fudge every single key exchange in order to read your traffic?

(The "locks on doors" argument.)

Re: Switch to HTTPS Now, For Free

#108

Post by icebraining »

conductor wrote: post #81

> As you can see, StartSSL will believe you own the domain if you control webmaster@, postmaster@, or hostmaster@ with the domain name I see a potential vuln here for free e-mail services. If one manages to register one of those addresses he can create a trusted certificate and use it for MITM.

That's why no free mail servers allow you to do that.

Re: Switch to HTTPS Now, For Free

#109

Post by slig »

AhtiK wrote: post #89

> And hey, bonus: more complete referrer information in Google Analytics It's interesting, I did switch to HTTPS for all my sites but Google Search still did not reveal search keywords to Google Analytics from users logged in at Google. If that's what was referred as "referrer information". Did anyone get lucky with getting 100% of google search keywords after switching to SSL?

They don't provide that anymore, even if you're on HTTPS.

I had this same question on a yesterday's thread: https://news.ycombinator.com/item?id=6438992

Re: Switch to HTTPS Now, For Free

#110

Post by TomGullen »

konklone wrote: post #65
espeed wrote: post #59

Make sure you do not use compression with SSL. Using compression with SSL could make your site vulnerable to the CRIME and BREACH attacks. See... SSL Gone in 30 Seconds - A BREACH Beyond CRIME [video]: http://www.youtube.com/watch?v=pIKIXQNFplY&hd=1 BREACH Attack (HTTP Compression): http://breachattack.com , http://security.stackexchange.com/questions/39925/breach-a-n... CRIME Attack (SSL/TLS/SPDY Compression): http:…

SSL Labs does a great job of SSL testing domains and making recommendations: https://www.ssllabs.com/ssltest/analyze.html?d=konklone.com I developed my nginx config based on their recommendations: https://gist.github.com/konklone/6532544

We just scored F: https://www.ssllabs.com/ssltest/analyze.html?d=scirra.com

But I'm not quite sure what I need to do to make it better?

Post reply on HN