Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Will Soon Shame All Websites That Are Unencrypted

motherboard.vice.com

Post reply on HN
Print view View original

141–150 of 369 posts

Re: Google Will Soon Shame All Websites That Are Unencrypted

#141

Post by threesixandnine »

artichokeheart wrote: post #78

I think one of the big problems with unencrypted websites is shared hosting, who refuse to use SNI certificates (often because it would require upgrading their infrastructure). So users have to pay for a static IP which effectively doubles their hosting costs so most don't bother.

If they don't bother why should people bother to pay for their hosting? There are many, many hosting companies that do bother and I am using one of them. Had no problem installing Let's Encrypt cert on shared hosting via cPanel there.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#142

Post by iancarroll »

geofft wrote: post #133
betenoire wrote: post #114

Earlier quoted context omitted.

Right. So what's the solution? I run my wife's retail website. Am I supposed to just stop worrying about caching static assets like product images, scripts, etc.? Do I just throw my hands in the air and assume it evens out because I switched to HTTPS? Serious question, what are my options?

Do you run the cache / contract with someone to run the cache, or are you worried about third parties who run caching servers out of your control (like mobile ISPs, corporate networks, etc.)? If the latter, I'm surprised/curious what the use case is. If the former, you can stick those on HTTPS too just fine. CloudFlare will be an entire SSL-enabled CDN for you for free. Amazon Cloudfront will serve SSL for you for fr…

Amazon Certificate Manager will issue certificates for CloudFront for free.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#143

Post by yeukhon »

ryanlol wrote: post #88
Someone1234 wrote: post #4

This is how it always should have been. It was mind boggling that mixed content was "insecure" but HTTP was "secure." HTTP is and always has been insecure and should be marked as such. I know there are a few people who will moan and groan about how overkill HTTPS is, but this isn't about banning HTTP it is just about reminding users that they shouldn't be entering sensitive information into a HTTP site. Even phishing…

>It was mind boggling that mixed content was "insecure" but HTTP was "secure." HTTP is and always has been insecure and should be marked as such. Why is it mind boggling? Content served over HTTP is obviously less sensitive than content served over HTTPS, mixed content breaks HTTPS.

No. Obviously less is wrong. Here is an example: login over HTTP deliberate because the site doesn't support HTTPS is definitely not less sensitive.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#144

Post by afarrell »

There are occasionally times when I want to suffer a MITM attack. For example, when I am on an airplane, at a hotel, or basically any other time I have to fill out a webform to get online. Perhaps those forms should not exist, but until they don't, I hope http://xkcd.com continues to work.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#145

Post by blakeyrat »

geofft wrote: post #32
oliv__ wrote: post #23

Why do we have to go through this whole SSL certificates thing and can't just have a simple, automatically secure, I-do-nothing-and-my-website-is-secure protocol? Seriously though. If secure is the default from now on, why can't it actually be the default?

Isn't that what Let's Encrypt is aiming for? Install a package, which configures a cronjob for you? https://letsencrypt.org/howitworks/ Which could just even become a default but optional dependency of your distro's web server package, or part of your Docker container, or whatever.

Ok I'm new to this and I know it's still beta, but it seems:

1. Still WAY too complicated (look at all the stuff you have to know and type)

2. Doesn't seem to support my preferred OS (Windows) or web server (IIS) what-so-ever. Which is strange since, from my experience, installing certs in IIS is already far easier than in Apache and Nginx. (Although maybe that's why they perceive it as less of a priority?)

Re: Google Will Soon Shame All Websites That Are Unencrypted

#146

Post by ninjakeyboard »

Should static content be encrypted over https? I think it's fair for chrome to call out with an x as I've literally seen local lunch joints take orders with credit card info over http but to serve mostly static pages like the new yorker over http only means that the user's privacy is compromised in that people can see what you're reading - does that warrant down ranking searches? I'm just curious - I work mostly on platforms so I'm not too aware of all of the incentives for trying to move everyone to https as it's not my problem domain necessarily.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#147

Post by ryanlol »

nothrabannosir wrote: post #117
ryanlol wrote: post #102

Earlier quoted context omitted.

>Without going into the question of how many bits of entropy that actually has when used with human beings in real settings, and just assume it's a perfect check; my question stands: how many people can you find who use this? Probably not very many, but it's really only useful for people that ignore basic security features anyway. (Key auth) >When they do: how many of your hosts do you know the image of? None, I use…

Does key auth protect you from a MITM on the first connection? That is, key auth as reasonable people use it, as you said. And this: > but it's really only useful for people that ignore basic security features anyway. (Key auth) is precisely the point: that's a lot of people. SSH doesn't work for those people. We can play the blame game, but at the end of the day, clearly something is "not right". And these are peopl…

>Does key auth protect you from a MITM on the first connection?

Yes. Key auth will protect you from your SSH connection being listened to, and will make credential theft reliant on social engineering. However, someone could still pretend to be the server (potentially stealing your commands), but there really doesn't exist any way to solve that.

>is precisely the point: that's a lot of people. SSH doesn't work for those people. We can play the blame game, but at the end of the day, clearly something is "not right".

Nothing works for those people, at least generally with SSH users you can assume that they should know better.

>Again: there is a way to use SSH properly, yes. But rare is the person who does this.

I'd hardly consider SSH key auth users rare.

>(But key auth is orthogonal to host fingerprinting anyway, this is kind of a red herring)

But it almost completely fixes the main problem caused by MitM, someone gaining access to the server you're logging into.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#148

Post by schoen »

afarrell wrote: post #144

There are occasionally times when I want to suffer a MITM attack. For example, when I am on an airplane, at a hotel, or basically any other time I have to fill out a webform to get online. Perhaps those forms should not exist, but until they don't, I hope http://xkcd.com continues to work.

Google has a service for this: https://www.chromium.org/chromium-os/chromiumos-design-docs/...

Re: Google Will Soon Shame All Websites That Are Unencrypted

#149

Post by ryanlol »

yeukhon wrote: post #143
ryanlol wrote: post #88

Earlier quoted context omitted.

>It was mind boggling that mixed content was "insecure" but HTTP was "secure." HTTP is and always has been insecure and should be marked as such. Why is it mind boggling? Content served over HTTP is obviously less sensitive than content served over HTTPS, mixed content breaks HTTPS.

No. Obviously less is wrong. Here is an example: login over HTTP deliberate because the site doesn't support HTTPS is definitely not less sensitive.

Of course, but there's a general expectation that stuff served over HTTP isn't sensitive.

Breaking HTTPS where it's deliberately used is something that certainly deserves a warning.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#150

Post by eknkc »

ninjakeyboard wrote: post #146

Should static content be encrypted over https? I think it's fair for chrome to call out with an x as I've literally seen local lunch joints take orders with credit card info over http but to serve mostly static pages like the new yorker over http only means that the user's privacy is compromised in that people can see what you're reading - does that warrant down ranking searches? I'm just curious - I work mostly on p…

One issue is content injection. You never know what transparent proxies are between you and the server, any one of them can add / remove content, scripts, tracking stuff etc to the static pages. You can't even be sure if your current DNS server resolved to the actual server and not some shady proxy.

I believe Comcast has been accused of doing something shady like that but I don't live in US and have no idea. Just read the news.

Post reply on HN