Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Will Soon Shame All Websites That Are Unencrypted

motherboard.vice.com

Post reply on HN
Print view View original

111–120 of 369 posts

Re: Google Will Soon Shame All Websites That Are Unencrypted

#111

Post by tyingq »

donohoe wrote: post #64

Which is hilarious because the reason I can't switch The New Yorker website to HTTPS is because of ads - which I'm getting from Google DFP which allows non-secure ad assets. In short; Google will penalize me because I use Google. The universe has a sense of humor.

This is also effectively true for the more broadly used Google Adsense (not just DFP). They do support displaying adsense, but then screen out all non-https ads. Which, of course, results in a lower CPM.[1]

[1]https://support.google.com/adsense/answer/10528?hl=en

>>In short; Google will penalize me because I use Google

+++

Re: Google Will Soon Shame All Websites That Are Unencrypted

#112

Post by geofft »

Nullabillity wrote: post #101
geofft wrote: post #86

Earlier quoted context omitted.

Huh, the rate limits look pretty generous (500 certs every 3 hours): https://community.letsencrypt.org/t/rate-limits-for-lets-enc... Do you actually own hundreds of personal websites? (And you could still desync them, anyway.) Or is this a use case where wildcards would be useful. I sort of disagree with LE's decision to not care about wildcards for now, though I understand that it's simpler, at least while it's in b…

That's per IP, you're also limited to 5 requests per domain name per week. In my case, I have a bunch of subdomains for various stuff that all counts against the limit for the main website. I suppose I ought to combine the CSRs, but implementing that makes it a bit more complex than just automatically requesting a certificate per nginx vhost.

Oh, that's pretty rough.

Still, with enough automation, you can request 5 per week in a cronjob, which will let you get at least 40-something websites, even with the recommended 60-day renewal cycle. :-P

Re: Google Will Soon Shame All Websites That Are Unencrypted

#113

Post by unicornporn »

bcg1 wrote: post #48
pmlnr wrote: post #17

Earlier quoted context omitted.

nada. http://letsencrypt.org/

Most shared hosting accounts charge extra for a dedicated IP address, both for setup and on a monthly basis. Don't underestimate how many blogs, churches, small businesses, etc still use services like that. To be fair, many of those sites probably ARE insecure, but it seems to be a little bit overkill to "shame" them for not implementing encryption.

I have shared hosting at Dreamhost. Installing Let's Encrypt certs was a two click procedure. I guess more hosting companies will follow.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#114

Post by betenoire »

EGreg wrote: post #108
mholt wrote: post #96

In the hopes that it will help spread adoption of HTTPS, I wrote a web server that serves your sites over HTTPS by default, using Let's Encrypt: https://caddyserver.com - It also redirects HTTP -> HTTPS.[1] There's a lot of misinformation out there about certificates and HTTPS, but don't let it stop you from encrypting your site. Regardless of Google's move, there is no excuse for any site not to be served encrypted…

Here's a good excuse for not using https for everything: it breaks caching of files by proxies!

Right. So what's the solution? I run my wife's retail website. Am I supposed to just stop worrying about caching static assets like product images, scripts, etc.? Do I just throw my hands in the air and assume it evens out because I switched to HTTPS?

Serious question, what are my options?

Re: Google Will Soon Shame All Websites That Are Unencrypted

#115

Post by plasticxme »

mholt wrote: post #96

In the hopes that it will help spread adoption of HTTPS, I wrote a web server that serves your sites over HTTPS by default, using Let's Encrypt: https://caddyserver.com - It also redirects HTTP -> HTTPS.[1] There's a lot of misinformation out there about certificates and HTTPS, but don't let it stop you from encrypting your site. Regardless of Google's move, there is no excuse for any site not to be served encrypted…

This is an awkward argument. One of my sites documents how to configure servers, for example. What excuse is there that something like that needs to be encrypted?

The most legitimate reason I've heard is for privacy. I don't believe the gov't is going to lock someone up for learning how to serve web pages.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#116

Post by realusername »

mholt wrote: post #96

In the hopes that it will help spread adoption of HTTPS, I wrote a web server that serves your sites over HTTPS by default, using Let's Encrypt: https://caddyserver.com - It also redirects HTTP -> HTTPS.[1] There's a lot of misinformation out there about certificates and HTTPS, but don't let it stop you from encrypting your site. Regardless of Google's move, there is no excuse for any site not to be served encrypted…

Sorry but I actualy can't load the website because of an HTTPS error (Firefox 43/Linux) (Error code : sec_error_ocsp_old_response).

Re: Google Will Soon Shame All Websites That Are Unencrypted

#117

Post by nothrabannosir »

ryanlol wrote: post #102
nothrabannosir wrote: post #83

Earlier quoted context omitted.

A band-aid, I'm afraid. Without going into the question of how many bits of entropy that actually has when used with human beings in real settings, and just assume it's a perfect check; my question stands: how many people can you find who use this? Many SSH clients don't even support it, at all. PuTTY and almost anything that uses SSH for tunneling. When they do: how many of your hosts do you know the image of? Again…

>Without going into the question of how many bits of entropy that actually has when used with human beings in real settings, and just assume it's a perfect check; my question stands: how many people can you find who use this? Probably not very many, but it's really only useful for people that ignore basic security features anyway. (Key auth) >When they do: how many of your hosts do you know the image of? None, I use…

Does key auth protect you from a MITM on the first connection?

That is, key auth as reasonable people use it, as you said.

And this:

> but it's really only useful for people that ignore basic security features anyway. (Key auth)

is precisely the point: that's a lot of people. SSH doesn't work for those people. We can play the blame game, but at the end of the day, clearly something is "not right".

And these are people who use SSH to begin with. Not typically technologically illiterate, I would guess. If they can't even be arsed to use "basic security features", what good is this system, then?

Again: there is a way to use SSH properly, yes. But rare is the person who does this.

(But key auth is orthogonal to host fingerprinting anyway, this is kind of a red herring)

Re: Google Will Soon Shame All Websites That Are Unencrypted

#118

Post by tyingq »

newjersey wrote: post #67
donohoe wrote: post #64

Which is hilarious because the reason I can't switch The New Yorker website to HTTPS is because of ads - which I'm getting from Google DFP which allows non-secure ad assets. In short; Google will penalize me because I use Google. The universe has a sense of humor.

They're trying to nudge their customers for a while. It is just a little difficult when that's one's biggest source of income. For example, https://support.google.com/dfp_sb/answer/4515432?hl=en

Also funny, because for many sites that run DFP or Adsense...that's their biggest source of income.

So, G is rationalizing their slow pace with the same reason that's not good enough for others :)

Re: Google Will Soon Shame All Websites That Are Unencrypted

#119

Post by Frizi »

EGreg wrote: post #108
mholt wrote: post #96

In the hopes that it will help spread adoption of HTTPS, I wrote a web server that serves your sites over HTTPS by default, using Let's Encrypt: https://caddyserver.com - It also redirects HTTP -> HTTPS.[1] There's a lot of misinformation out there about certificates and HTTPS, but don't let it stop you from encrypting your site. Regardless of Google's move, there is no excuse for any site not to be served encrypted…

Here's a good excuse for not using https for everything: it breaks caching of files by proxies!

That's what CDNs are for. If you control your proxy, nothing prevents you from giving it access to your https by setting up your private key on it. Https is also tapable, but only by servers you trust.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#120

Post by bigiain »

EGreg wrote: post #108
mholt wrote: post #96

In the hopes that it will help spread adoption of HTTPS, I wrote a web server that serves your sites over HTTPS by default, using Let's Encrypt: https://caddyserver.com - It also redirects HTTP -> HTTPS.[1] There's a lot of misinformation out there about certificates and HTTPS, but don't let it stop you from encrypting your site. Regardless of Google's move, there is no excuse for any site not to be served encrypted…

Here's a good excuse for not using https for everything: it breaks caching of files by proxies!

The more privacy-conscious amongst us probably consider that a positive reason not a negative one...
Post reply on HN