Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Still Why No HTTPS?

troyhunt.com

Post reply on HN
Print view View original

131–140 of 345 posts

Re: Still Why No HTTPS?

#131

Post by oneeyedpigeon »

simias wrote: post #114
edf13 wrote: post #96

The biggest problem with forcing everything HTTPS is a false sense of security & trust that this gives to none-techie users. Security of the data transfer layer does not mean can or should trust the website you are visiting. Just because a website has a padlock does not mean it is trust worthy and you can hand over your CC details. https://www.amazon.somethiing.other.co/greatDiscount may look great to some!

If we migrate to HTTPS everywhere we can get rid of HTTP for general use and switch to a different UI, where HTTPS websites don't have any special icon but HTTP ones get a warning icon. It's already effectively how password form submissions work in many browsers.

We could already do that — just do away with the padlock icon now. In my browser, anyway, http:// gives a big "non secure" warning.

Re: Still Why No HTTPS?

#132

Post by minitech »

edf13 wrote: post #96

The biggest problem with forcing everything HTTPS is a false sense of security & trust that this gives to none-techie users. Security of the data transfer layer does not mean can or should trust the website you are visiting. Just because a website has a padlock does not mean it is trust worthy and you can hand over your CC details. https://www.amazon.somethiing.other.co/greatDiscount may look great to some!

This is exactly the opposite of a forcing HTTPS problem. When HTTPS isn’t everywhere, HTTPS gives a false sense of security. When it is, browsers can stop emphasizing it. We’re already well down that path, with padlocks no longer being green/being hidden entirely, EV certificates losing their confusion vector, insecure pages being assigned the icon that sticks out…

Re: Still Why No HTTPS?

#133

Post by acdha »

kevingadd wrote: post #64
Sukera wrote: post #33

Earlier quoted context omitted.

Do you have a source on that? Quite a few people seem to disagree: https://istlsfastyet.com/

In my testing for high-throughput scenarios like copies over ssh/rsync/https/smb (i tried them all) in every case encryption was a big hit to throughput. hardware assistance (built into the CPU) helped a lot but it was still a massive boost to shut off encryption - saving literal minutes on every bulk transfer, multiple transfers per day. For the average case it probably doesn't matter, and you can optimize it, but I…

How long ago was this — and how fast was your network? On hardware less than a decade old you shouldn’t be seeing that unless you’re talking about 10+Gb networking.

Re: Still Why No HTTPS?

#135

Post by oneeyedpigeon »

satanspastaroll wrote: post #116
davidmurdoch wrote: post #112

One potentially good reason to not force SSL: https://meyerweb.com/eric/thoughts/2018/08/07/securing-sites... TL;DR: Secure websites can make the web less accessible for those who rely on metered satellite internet (and I'm sure plenty of other cases).

Trading security for convenience is rarely a good idea. The rest of the world should not conform the to failures of certain areas to provide internet.

No, but it's a good idea to have the option, so long as people are aware of the implications.

Re: Still Why No HTTPS?

#136

Post by ninkendo »

dijit wrote: post #73
cassianoleal wrote: post #3

I mostly have port 80 egress traffic blocked on Little Snitch. The web is painful to use like that but gives you an idea of the sorry state of websites. A lot of websites just don't serve over HTTPS, or serve them with domains whose CN or SAN don't match the host. Many that do support https have links that downgrade you back to http on the same domain.

How do you use public Wi-Fi with captive portals?

Allowing http://captive.apple.com should make macOS’s captive portal auth window work.

Re: Still Why No HTTPS?

#137

Post by kuschku »

altmind wrote: post #97

Preloads list is an absolute kludge that does not and will never scale and creates a huge deal of problems and works only for specific browsers. The task is not as simple as using DNS to store strict https flags(as DNS can be manipulated by intermediary), but hardcoding the lists in the browsers and keeping the lists in the chrome's code is definitely not a solution.

The goal is to slowly move higher levels into that list.

e.g. in the past it was just domains and subdomains.

Today there are already some TLDs on the list themselves.

Re: Still Why No HTTPS?

#138

Post by greggman2 »

simias wrote: post #114
edf13 wrote: post #96

The biggest problem with forcing everything HTTPS is a false sense of security & trust that this gives to none-techie users. Security of the data transfer layer does not mean can or should trust the website you are visiting. Just because a website has a padlock does not mean it is trust worthy and you can hand over your CC details. https://www.amazon.somethiing.other.co/greatDiscount may look great to some!

If we migrate to HTTPS everywhere we can get rid of HTTP for general use and switch to a different UI, where HTTPS websites don't have any special icon but HTTP ones get a warning icon. It's already effectively how password form submissions work in many browsers.

You can't have HTTPS everywhere until we can get HTTPS for IoT devices. My router doesn't serve it's configuration screen via HTTPS. How could it? I have to connect to it to configure it before it's on the internet.

Same with my IoT cameras and all the various local apps I run that can start a web server. Heck, my iPhone has tons of apps that start webservers for uploading data since iPhone's file sync sucks so bad.

We need a solution to HTTPS for devices inside home networks.

Re: Still Why No HTTPS?

#139

Post by kuschku »

elcomet wrote: post #12
chungy wrote: post #9

Earlier quoted context omitted.

Instructions are here: https://certbot.eff.org/ I don't know how it could possibly be any simpler.

It is simple for a one-server website. When you're on Alexa 1M, you certainly have a load balancer, multiple servers for redundancy, etc. It makes things not straightforward, and you certainly don't want to use the default certbot which overwrites your config.

That's why you set custom NS records for _acme-challenge.domain.tld to your own NS servers and use the DNS challenge to get your certs.

Re: Still Why No HTTPS?

#140

Post by Liquid_Fire »

ninkendo wrote: post #136
dijit wrote: post #73

Earlier quoted context omitted.

How do you use public Wi-Fi with captive portals?

Allowing http://captive.apple.com should make macOS’s captive portal auth window work.

Most captive portals I've seen use HTTP redirection to the actual domain of the captive portal, so it would still fail as soon as it follows the redirected URL.
Post reply on HN