Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Still Why No HTTPS?

troyhunt.com

Post reply on HN
Print view View original

111–120 of 345 posts

Re: Still Why No HTTPS?

#111

Post by sturgill »

founderling wrote: post #70

Because there is only one free certificate provider (lets encrypt) and it does not allow wildcard certificates via server authentification. Having the DNS credentials laying around on the server is not a good idea. So creating wildcard certs via letsencrypt is a huge pain in the ass. If a webmaster has control over somedomain.com I think that is enough to assume he has control over *.somedomain.com. So I think letsen…

AWS certificates are free. Cloudflare will also put SSL in front of your origin for free.

So if you’re using AWS you get it for free. Or you can slap CloudFront or Cloudflare in front of your origin.

I think the barrier is low enough that I SSL all the things (including my small side projects).

Re: Still Why No HTTPS?

#113

Post by BrandoElFollito »

Because HTTPS is not as easy as HTTP.

Sure there is Let's Encrypt and if you are facing Internet you are probably good to go.

If you are on an internal network, then good luck. You need to build a PKI, and then put into your devices the right certificate so that it is trusted.

If it was simpler, Apache would sing out its "It works!" in HTTPS and not HTTP.

Re: Still Why No HTTPS?

#114

Post by simias »

edf13 wrote: post #96

The biggest problem with forcing everything HTTPS is a false sense of security & trust that this gives to none-techie users. Security of the data transfer layer does not mean can or should trust the website you are visiting. Just because a website has a padlock does not mean it is trust worthy and you can hand over your CC details. https://www.amazon.somethiing.other.co/greatDiscount may look great to some!

If we migrate to HTTPS everywhere we can get rid of HTTP for general use and switch to a different UI, where HTTPS websites don't have any special icon but HTTP ones get a warning icon.

It's already effectively how password form submissions work in many browsers.

Re: Still Why No HTTPS?

#115

Post by zurn »

BrandoElFollito wrote: post #113

Because HTTPS is not as easy as HTTP. Sure there is Let's Encrypt and if you are facing Internet you are probably good to go. If you are on an internal network, then good luck. You need to build a PKI, and then put into your devices the right certificate so that it is trusted. If it was simpler, Apache would sing out its "It works!" in HTTPS and not HTTP.

Let's Encrypt works on internal networks too.

Fun fact: TLS doesn't require certificates, and some browsers even used to support HTTPS in these TLS modes many moons ago. See eg https://security.stackexchange.com/questions/23024/can-diffi...

Re: Still Why No HTTPS?

#116

Post by satanspastaroll »

davidmurdoch wrote: post #112

One potentially good reason to not force SSL: https://meyerweb.com/eric/thoughts/2018/08/07/securing-sites... TL;DR: Secure websites can make the web less accessible for those who rely on metered satellite internet (and I'm sure plenty of other cases).

Trading security for convenience is rarely a good idea. The rest of the world should not conform the to failures of certain areas to provide internet.

Re: Still Why No HTTPS?

#117

Post by BrandoElFollito »

zurn wrote: post #115
BrandoElFollito wrote: post #113

Because HTTPS is not as easy as HTTP. Sure there is Let's Encrypt and if you are facing Internet you are probably good to go. If you are on an internal network, then good luck. You need to build a PKI, and then put into your devices the right certificate so that it is trusted. If it was simpler, Apache would sing out its "It works!" in HTTPS and not HTTP.

Let's Encrypt works on internal networks too. Fun fact: TLS doesn't require certificates, and some browsers even used to support HTTPS in these TLS modes many moons ago. See eg https://security.stackexchange.com/questions/23024/can-diffi...

Ah? That's good to know!

How to set this up on a domain which is not connected to Internet? How is the check done?

Re: Still Why No HTTPS?

#118

Post by blowski »

M2Ys4U wrote: post #94
veb wrote: post #5

I don't get it. With Lets Encrypt, it's like one or two lines to get everything set up. I'm guessing people aren't as lucky as I am to be running on newer machines and such. I mean it even edits your nginx files to redirect http to https if you agree. It's not hard.

> I don't get it. With Lets Encrypt, it's like one or two lines to get everything set up. My employer won't use Let's Encrypt because they (LE) want unlimited indemnity and that's a deal breaker for them (employer).

To add to your point, a lot of insurers only provide cyber insurance with a certificate from a specific range of CAs, and LetsEncrypt is not one of them. Frustratingly, Symantec is allowed.

Re: Still Why No HTTPS?

#120

Post by ktpsns »

Because frankly, I neither trust letsencrypt nor the certificate authority system in general. This might prevent eavesdropping in your coffee shop wifi, but won't help against industrial spionage powered by three-letter-agencies who probably control some of these authorities.
Post reply on HN