Live data from Hacker News

HTTPS by default

security.googleblog.com

111–120 of 268 posts

Re: HTTPS by default

#111
post #86

Earlier quoted context omitted.

The threat model of HTTP isn't site owners, it's that anyone else can change the content and you can't tell that it didn't come from the original site. It's not a strawman, it's a real attack that we've seen for decades. The entire guidance of "don't connect to an open wireless AP"? That's because a malicious actor who controlled the AP could read and modify your HTTP traffic - inject ads, read your passwords, update…

Then perhaps the problem is open APs? There are still legitimate uses for HTTP including reading static content. Say we all move to HTTPS but then let’s encrypt goes away, certificate authority corps merge, and then google decides they also want remote attestation for two way trust or whatever - the whole world becomes walled up into an iOS situation. Even a good idea is potentially very bad at the hands of unregulat…

> There are still legitimate uses for HTTP including reading static content.

This can still be MITM'd. Maybe they can't drain your bank account by the nature of the content, but they can still lie or something. And that's not good.

Re: HTTPS by default

#112
post #40
post #25

Earlier quoted context omitted.

There are dozens of us I guess that care about this kind of thing. I have never really understood the obsession with https for static content that I don't care if anyone can see I am reading like a blog post. HTTPS should be for things that matter, everything else can, and think should use HTTP when it is not necessary. Depending on yet another third party to provide what is IMHO a luxury should not be required, and…

Just because you don't care doesn't mean nobody cares. I don't want anyone snooping on what I browse regardless of how "safe" someone thinks it is. My navigation habits are boring but they are mine , not anyone else's to see. A server has no way to know whether the user cares or not, so they are not in a position to choose the user's privacy preferences. Also: a page might be fully static, but I wouldn't want $GOVERN…

And so we got The Usual Conversation:

"I want my communications to be as secure as practical."

"Ah, but they're not totally secure! Which means they're totally insecure! Which means you might as well write your bank statements on postcards and mail them to the town gossip!"

It amazes me how anti-HTTPS some people can be.

Re: HTTPS by default

#115
> What's worse, many plaintext HTTP connections today are entirely invisible to users, as HTTP sites may immediately redirect to HTTPS sites. That gives users no opportunity to see Chrome's "Not Secure" URL bar warnings after the risk has occurred, and no opportunity to keep themselves safe in the first place.

What is the risk exactly? A man-in-the-middle redirect to a malicious https site?

Re: HTTPS by default

#116

> One year from now, with the release of Chrome 154 in October 2026... Wait a minute, how do they know what version Chrome will be at a year from now?

Chrome has a set release schedule, shipping a new major release every four weeks.

https://chromium.googlesource.com/chromium/src/+/HEAD/docs/p...

Re: HTTPS by default

#118
post #21

Earlier quoted context omitted.

Depend on one less third party, you still depend on the DNS Root servers, your ISP / hosting, domain registry, etc.

Let's Encrypt pushes me to run its self-updating certbot on my personal server, which is a big no-go. I know about acme.sh, but still...

There is a plethora of other clients besides certbot or acme.sh.

Re: HTTPS by default

#119
post #33
post #21

Earlier quoted context omitted.

Depend on one less third party, you still depend on the DNS Root servers, your ISP / hosting, domain registry, etc.

Host an onion website at home using solar energy, and the only third party your website will depend on is your internet provider :)

And an army of volunteers and feds to run relays

Re: HTTPS by default

#120
post #91

Mmmm, great that and mandatory key rotation every 90 days, plus needing to get a cert from an approved CA, means just that more busy work to have an independent web presence. I don't like people externalizing their security policy preferences. Yes this might be more secure for a class of use-cases, but I as a user should be allowed to decide my threat model. It's not like these initiatives really solve the risks pose…

You understand that key rotation can and should be automated, right?
Post reply on HN