Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Still Why No HTTPS?

troyhunt.com

Post reply on HN
Print view View original

121–130 of 345 posts

Re: Still Why No HTTPS?

#121

Post by benoliver999 »

BrandoElFollito wrote: post #117
zurn wrote: post #115

Earlier quoted context omitted.

Let's Encrypt works on internal networks too. Fun fact: TLS doesn't require certificates, and some browsers even used to support HTTPS in these TLS modes many moons ago. See eg https://security.stackexchange.com/questions/23024/can-diffi...

Ah? That's good to know! How to set this up on a domain which is not connected to Internet? How is the check done?

It's not easy but iirc you can do it with a DNS-01 challenge, if your internal domain name is valid (doesn't have to resolve to anything though).

Re: Still Why No HTTPS?

#122

Post by zurn »

BrandoElFollito wrote: post #117
zurn wrote: post #115

Earlier quoted context omitted.

Let's Encrypt works on internal networks too. Fun fact: TLS doesn't require certificates, and some browsers even used to support HTTPS in these TLS modes many moons ago. See eg https://security.stackexchange.com/questions/23024/can-diffi...

Ah? That's good to know! How to set this up on a domain which is not connected to Internet? How is the check done?

It works over DNS. There is a lot written about it on the net, I don't have any specific recommended article.

Re: Still Why No HTTPS?

#123

Post by peterwwillis »

ktpsns wrote: post #120

Because frankly, I neither trust letsencrypt nor the certificate authority system in general. This might prevent eavesdropping in your coffee shop wifi, but won't help against industrial spionage powered by three-letter-agencies who probably control some of these authorities.

This feels a bit like saying, I'm not going to use a traditional wood beam and shingled roof for my house, because it won't help against a meteor.

Re: Still Why No HTTPS?

#124

Post by BrandoElFollito »

zurn wrote: post #122
BrandoElFollito wrote: post #117

Earlier quoted context omitted.

Ah? That's good to know! How to set this up on a domain which is not connected to Internet? How is the check done?

It works over DNS. There is a lot written about it on the net, I don't have any specific recommended article.

I now how to do the check over DNS when the name is known outside - the problem is that I have my own internal domain not visible on Internet

Re: Still Why No HTTPS?

#125

Post by minitech »

ktpsns wrote: post #120

Because frankly, I neither trust letsencrypt nor the certificate authority system in general. This might prevent eavesdropping in your coffee shop wifi, but won't help against industrial spionage powered by three-letter-agencies who probably control some of these authorities.

So because you think it’s not a good enough defense against three-letter agencies, you’ll let everyone else continue to eavesdrop too? Controlling a CA isn’t even enough to strip confidentiality, there needs to be an active (private keys!) and ideally public (certificate transparency, CAA) attack on top of that that entities who can pull it off definitely won’t want to waste.

Re: Still Why No HTTPS?

#126

Post by BrandoElFollito »

benoliver999 wrote: post #121
BrandoElFollito wrote: post #117

Earlier quoted context omitted.

Ah? That's good to know! How to set this up on a domain which is not connected to Internet? How is the check done?

It's not easy but iirc you can do it with a DNS-01 challenge, if your internal domain name is valid (doesn't have to resolve to anything though).

The problem is that I also have domains which are completely internal, not known/resolvable outside

Re: Still Why No HTTPS?

#127

Post by squiggleblaz »

WilliamEdward wrote: post #8
veb wrote: post #5

I don't get it. With Lets Encrypt, it's like one or two lines to get everything set up. I'm guessing people aren't as lucky as I am to be running on newer machines and such. I mean it even edits your nginx files to redirect http to https if you agree. It's not hard.

I'm fine with people who think it's too hard... What i cannot stand is people who can do it, but refuse to out of laziness. Or because they want their content to be insecure on purpose. This applies mostly to big orgs, so indie devs can have some leeway if it's too hard to implement.

I don't do it on my own site. I'm capable of doing it, and certainly did it for my job. But my own site... It's free with HTTP, but they charge for every level that includes HTTPS. I'm it's major user (so far) so \/\/

Re: Still Why No HTTPS?

#128

Post by enriquto »

WilliamEdward wrote: post #4

Some websites adamantly insist they did not need HTTPS because they are purely static. https://www.troyhunt.com/heres-why-your-static-website-needs... The same website to my surprise has an article on why this is faulty reasoning.

my static website is a sand castle in the beach. When I'm not around, kids may break it, or a random person may impersonate as its creator. That is alright, it is just a sand castle. The only purpose of its existence is to provide casual onlookers a nice view (or read) for a few minutes.

Having to set up a "certificate" for that would be an unacceptable burden.

Re: Still Why No HTTPS?

#129

Post by peterwwillis »

Recently an OpenShift cluster I admin went down because of long-lived certs not being rotated in time. There are many clients, servers, nodes, services, and configs involved, so rotating is non-trivial, so of course it's automated, and of course because it's not tested regularly, the automation just doesn't work after a while. Using the automation only seems to make things worse, and getting everything working again ends up taking days.

PKI is technically the best practice for these systems, but it's also the most fragile and complicated. At a certain point, if the security model is so complex that it becomes hard to reason about, it's arguable that it's no longer a secure model, to say nothing of operational reliability.

I also have a whole rant about how some business models and government regulations literally require inspecting TLS certs of critical transport streams, and how the protocols are designed only to prevent this, and all the many problems this presents as a result, but I don't think most people care about those concerns.

Oh, and gentle reminder that there are still 100% effective attacks that allow automated generation of valid certs for domains you don't control. It doesn't happen frequently (that we know of) but it has happened multiple times in the past decade, so just having a secure connection to a website doesn't mean it's actually secure.

Re: Still Why No HTTPS?

#130

Post by dijit »

throw0101a wrote: post #90
dijit wrote: post #75

I have a reason not to use https. I host a single site on a host (so, no login, subject name or path information to leak), which only contains details how to connect to my irc server at the same address. If the message is altered then the most pain anyone will have is connecting somewhere else for the first time. (They won’t be automatically logging in if they’re using this page). Why does everything need to be TLS?…

> Why does everything need to be TLS? It feels like a cargo cult. A requirement: “because!” Traditionally, people have only encrypted things that are deemed sensitive (logins, money, health). However, when the majority of traffic is non-encrypted, actually ciphered data is very noticeable to anyone monitoring the network, and it screams " look at me! I am important! ". However, when >90% of traffic of the Internet is…

"herd immunity" is a good argument; but herd immunity exists for outliers. The people who for some reason cannot get a vaccine, yet they are not exposed to the hypothetical disease because everyone they are surrounded by is immune.

That's kinda my argument, not that https is bad. I agree with widespread adoption and taking it as a default even for a static page.

But in my environment I have many dozens of nodes and idk where letsencrypt is going to come in because of geobalanced DNS. I also serve many domains with this project so I don't have the nice DNS-01 ACME verification features because not all DNS providers have an API.

So I have a web server on each node, which reverse proxies .well-known/ to some central server that runs certbot. Then I distribute those certs outwards to those nodes.

It goes against certain sysadmin principles about transportation of private key materials, but it's what works.

But; given that architecture which caters for a latency sensitive product; letsencrypt is a serious overhead. To the point where I'm considering going back to 2y paid certs.

Post reply on HN