Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encrypted web traffic now exceeds 90%

netmarketshare.com

Post reply on HN
Print view View original

111–120 of 311 posts

Re: Encrypted web traffic now exceeds 90%

#111

Post by UncleMeat »

input_sh wrote: post #68
mholt wrote: post #5

Good news for sure, but note that this isn't a total Internet scan: > We collect data from the browsers of site visitors to our exclusive on-demand network of analytics and social bookmarking products. More details about their samples: https://netmarketshare.com/methodology I would be more inclined to trust sources like https://transparencyreport.google.com/https/overview and Firefox Telemetry which come directly fro…

> from mobile apps (most of which have to be encrypted now I think) Since the end of 2016 on iOS and since Android v9, apps have to communicate over HTTPS. I guess you can technically visit HTTP sites via a browser, but I'd bet that >90% of the traffic from smartphones is over HTTPS.

> since Android v9, apps have to communicate over HTTPS

That isn't true. It is the default but Android lets you override the defaults and use unencrypted traffic both in WebViews and in networking APIs.

Re: Encrypted web traffic now exceeds 90%

#112

Post by jdormit »

phonethrowaway wrote: post #102
samatman wrote: post #98

Earlier quoted context omitted.

Several reasons: - The good is not the enemy of the perfect. - This eliminates an entire class of attacks, namely, man-in-the-middle. - A lot of (most?) user interactions require the server to know what the user wants, and it's unclear how this can happen if the server can't view the user's data.

MITM is not mitigated at all by HTTPS. What makes you think that? Do you understand how certificate signing works?

...do you? Unless the attacker has access to the private key associated with the SSL certificate, they can't read any HTTPS traffic encrypted via that certificate - mitigating the ability of that bad actor to perform a MITM attack.

Re: Encrypted web traffic now exceeds 90%

#113

Post by gnode »

whydoyoucare wrote: post #91

This statement would be more meaningful had it been phrased something like this: "encrypted web traffic, which most adversaries cannot snoop on, exceeds 90%". There will always be an adversary, far powerful than you, with an ability to snoop on your traffic - be it your ISP, the other endpoint, or owners of the infrastructure that you consume, but do not control.

You portray encryption as a magical energy. To the best understanding of cryptanalysis research, current TLS is secure. Hypothetically it could be broken and publicly unknown, but this is not a matter of "power".

> the other endpoint

It's not sensible to say encrypted web traffic is snooped on by an actor with direct access to the plaintext.

Re: Encrypted web traffic now exceeds 90%

#115

Post by wolco »

taftster wrote: post #48
alpb wrote: post #45

Also likely because in the past the internet was really diverse. One would visit 20 sites possibly during one session. Today, the landscape looks more like: You visit Google, click some links that open in AMP (still Google), visit some social networks (primarily Twitter and FB-owned properties). These companies already operate TLS-only, which helps these numbers.

Right. Encrypted web traffic at 90% is different than encrypted web sites at 90%.

When netflix is half, torrent traffic included add in google/facebook/faangs and you arrive at 90% easily.

Re: Encrypted web traffic now exceeds 90%

#116

Post by gpm »

UncleMeat wrote: post #108
gpm wrote: post #83

Earlier quoted context omitted.

> can you imagine the scandal that would erupt if Google or AWS cloud was discovered to be eavesdropping on companies running things in their cloud Remember the "SSL added and removed here" image? https://thumbs.mic.com/MTBjNTQzNTMzZiMvbWVtejZOdjJsaUdUVkZEa...

That wasn't eavesdropping by Google. That was Google not using encrypted traffic on internal wires. And that changed a lot of years ago.

Yes, it was the US government eavesdropping for them without their consent, but the end result is basically the same.

Yes, that exact hole was patched, but the point is it wasn't the end of the world that great grandparent implied it would be.

Re: Encrypted web traffic now exceeds 90%

#117

Post by qvrjuec »

jdormit wrote: post #112
phonethrowaway wrote: post #102

Earlier quoted context omitted.

MITM is not mitigated at all by HTTPS. What makes you think that? Do you understand how certificate signing works?

...do you? Unless the attacker has access to the private key associated with the SSL certificate, they can't read any HTTPS traffic encrypted via that certificate - mitigating the ability of that bad actor to perform a MITM attack.

The above poster is still technically correct though, getting the cert is just 1 more obstacle in the way of the attack, which isn't as much of an obstacle as one would think for some actors(see China).

Re: Encrypted web traffic now exceeds 90%

#118

Post by markovbot »

phonethrowaway wrote: post #102
samatman wrote: post #98

Earlier quoted context omitted.

Several reasons: - The good is not the enemy of the perfect. - This eliminates an entire class of attacks, namely, man-in-the-middle. - A lot of (most?) user interactions require the server to know what the user wants, and it's unclear how this can happen if the server can't view the user's data.

MITM is not mitigated at all by HTTPS. What makes you think that? Do you understand how certificate signing works?

If https doe not mitigate MITM attacks, what is the purpose of it?

Re: Encrypted web traffic now exceeds 90%

#119

Post by autoexec »

Jonnax wrote: post #11

Nice. Remember the days when IT professionals would exclaim that this was a bad idea? Seems like it's cyclical thing. DNS over HTTPS is now the big bad technology.

> Nice. Remember the days when IT professionals would exclaim that this was a bad idea?

It has made some things more difficult. In the old days when I had problems with a remote IMAP server I could watch each command and response going over the wire. It made troubleshooting dead simple. When a POP3 mailbox got hung up on a single huge message you could just telnet in and delete the offending message in a few seconds. It's crazy to suggest that encrypting everything hasn't made things more complicated than they were. It hasn't been an insurmountable problem, and in an age where everyone wants to sell your browsing habits the rewards have been greater than the pain but it did make things harder.

Re: Encrypted web traffic now exceeds 90%

#120

Post by theonemind »

phonethrowaway wrote: post #102
samatman wrote: post #98

Earlier quoted context omitted.

Several reasons: - The good is not the enemy of the perfect. - This eliminates an entire class of attacks, namely, man-in-the-middle. - A lot of (most?) user interactions require the server to know what the user wants, and it's unclear how this can happen if the server can't view the user's data.

MITM is not mitigated at all by HTTPS. What makes you think that? Do you understand how certificate signing works?

How does certificate signing not mitigate man-in-the-middle? Say you have control of DNS and you can fully impersonate and replace any server. You present a valid certificate for the server. It has the public key, which the client uses to try to encrypt traffic. The man-in-the-middle doesn't have the private certificate. You convince the client its talking to the right machine, but then you can't understand anything the client has to say, because it uses the legitimate public key.

Say you have control of the infrastructure and you forge a certificate. You'll have a hard time getting the client to trust the certificate unless you have compromised the signing key of a certificate authority and generated an apparently valid cert.

So, can it entirely prevent it? Can I get verisign to issue me a certificate for G00GLE INC.? If you can alter the client's list of trusted authorities, you can make yourself an authority, but you've already compromised the client. If you can get the server's private certificate, you've compromised the server. You can get creative, sure...probably, you stand a better chance of beating the people in the chain than the technology...but the difficulty of doing so seems to amount to 'mitigation' at the least.

Post reply on HN