Encrypted web traffic now exceeds 90% • Hacker News Board

Re: Encrypted web traffic now exceeds 90%

#151

Post by codedokode » Fri, Nov 01, 2019, 10:28 PM UTC

edoo wrote: post #147

svara wrote: post #73

We often hear the complaint here that nobody cares / cared about Snowden's revelations. But to me it seems he did provide a lot of the impetus for having HTTPS virtually everywhere and a lot of the instant messenging apps being end-to-end encrypted. Most of WhatsApp's users are as non-technical as it gets, and yet they use the kind of encryption that only computer enthusiasts were interested in just a couple years ag…

What happens if an agency gets in deep with one of the common trusted authorities shipped with every browser, or is an authority, or just hacked their root keys, or bought access like they did with RSA? It seems like they could man in the middle all day and the only difference would be the cert issuer, which means it would be invisible if used in a limited fashion.

It is still better than situation where everyone would use HTTP and naively believe that authorities will respect their right for privacy.

Re: Encrypted web traffic now exceeds 90%

#152

Post by birdyrooster » Fri, Nov 01, 2019, 10:32 PM UTC

gscott wrote: post #148

This is good to keep out moderate bad guys from your data. But the not so much for the NSA. The NSA already captures traffic end to end including the key negotiation and can break the rest https://arstechnica.com/information-technology/2015/10/how-t...

That was for 1024-bit SSL keys with specific primes, going to 2048-bit will not scale with $11B

Re: Encrypted web traffic now exceeds 90%

#153

Post by avian » Fri, Nov 01, 2019, 10:37 PM UTC

brycesbeard wrote: post #150

noitkjerh wrote: post #149

Earlier quoted context omitted.

Snowden was a factor, but not the only one: - CPUs didn't have hardware acceleration for encryption (AES-NI) like they have today, so activating SSL on your webserver actually decreased your throughput a lot - It was expensive and complicated to get a certificate for your website, now LetsEncrypt provides them freely and easily

Wasn’t the server load for ssl something like 3-5%? That doesn’t strike me as much of a factor as the complexity involved, especially with the confusion added by eg Thawte hawking their enhanced validation product.

"On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load" according to Google back in January 2010 [1]. This was about the same time as Intel introduced AES instructions, but the post suggests that this wasn't a big factor in their conclusion that TLS simply isn't computationally expensive.

[1] https://www.imperialviolet.org/2010/06/25/overclocking-ssl.h...

Re: Encrypted web traffic now exceeds 90%

#154

Post by kome » Fri, Nov 01, 2019, 10:39 PM UTC

Andrew_nenakhov wrote: post #129

svara wrote: post #73

We often hear the complaint here that nobody cares / cared about Snowden's revelations. But to me it seems he did provide a lot of the impetus for having HTTPS virtually everywhere and a lot of the instant messenging apps being end-to-end encrypted. Most of WhatsApp's users are as non-technical as it gets, and yet they use the kind of encryption that only computer enthusiasts were interested in just a couple years ag…

Ironically, Telegram markets itself as the most private and secure messenger, but in reality, it's much less private than WhatsApp or Viber: any regular (non-secret) Telegram chats are not end-to-end encrypted - if they were, you wouldn't be able to access them from a new device after authorization with a password.

they are not end-to-end encrypted but they are encrypted. Also, I read that WhatsApp is going to switch to the same mode, for user convenience: https://bgr.com/2019/07/29/whatsapp-update-to-bring-multi-pl...

Re: Encrypted web traffic now exceeds 90%

#155

Post by edoo » Fri, Nov 01, 2019, 10:40 PM UTC

codedokode wrote: post #151

edoo wrote: post #147

Earlier quoted context omitted.

What happens if an agency gets in deep with one of the common trusted authorities shipped with every browser, or is an authority, or just hacked their root keys, or bought access like they did with RSA? It seems like they could man in the middle all day and the only difference would be the cert issuer, which means it would be invisible if used in a limited fashion.

It is still better than situation where everyone would use HTTP and naively believe that authorities will respect their right for privacy.

I'd almost prefer to be on http knowing I was insecure than be on https and wrongly believing I was secure.

Re: Encrypted web traffic now exceeds 90%

#156

Post by philipkglass » Fri, Nov 01, 2019, 10:40 PM UTC

gscott wrote: post #148

This is good to keep out moderate bad guys from your data. But the not so much for the NSA. The NSA already captures traffic end to end including the key negotiation and can break the rest https://arstechnica.com/information-technology/2015/10/how-t...

Even when it was first discovered, only 8.4% of the top million web sites were estimated to be vulnerable to the Logjam attack:

https://arstechnica.com/information-technology/2015/05/https...

Now I would expect the number to be much closer to 0%.

Re: Encrypted web traffic now exceeds 90%

#157

Post by ridaj » Fri, Nov 01, 2019, 10:42 PM UTC

gambler wrote: post #67

I don't know why so many people here are patting themselves on the back over this. This is not the kind of encryption people were talking about in the 90s and 00s. A lot of this encryption is not point-to-point. It merely secures user's interaction with some middleman (or their server). What would the numbers be if you subtracted all the traffic that can be snooped on by Google, Amazon and Cloudflare?

The acceleration of this global trend in recent years can reasonably be attributed to the actions of one person.

Re: Encrypted web traffic now exceeds 90%

#158

Post by matheusmoreira » Fri, Nov 01, 2019, 10:43 PM UTC

edoo wrote: post #147

svara wrote: post #73

We often hear the complaint here that nobody cares / cared about Snowden's revelations. But to me it seems he did provide a lot of the impetus for having HTTPS virtually everywhere and a lot of the instant messenging apps being end-to-end encrypted. Most of WhatsApp's users are as non-technical as it gets, and yet they use the kind of encryption that only computer enthusiasts were interested in just a couple years ag…

What happens if an agency gets in deep with one of the common trusted authorities shipped with every browser, or is an authority, or just hacked their root keys, or bought access like they did with RSA? It seems like they could man in the middle all day and the only difference would be the cert issuer, which means it would be invisible if used in a limited fashion.

They could definitely do that. They could also mandate the use of "national security certificates".

https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_a...

Re: Encrypted web traffic now exceeds 90%

#159

Post by hcarvalhoalves » Fri, Nov 01, 2019, 10:44 PM UTC

svara wrote: post #73

We often hear the complaint here that nobody cares / cared about Snowden's revelations. But to me it seems he did provide a lot of the impetus for having HTTPS virtually everywhere and a lot of the instant messenging apps being end-to-end encrypted. Most of WhatsApp's users are as non-technical as it gets, and yet they use the kind of encryption that only computer enthusiasts were interested in just a couple years ag…

If people really listened to Snowden they wouldn't be relying on CA authorities for certificates.

Re: Encrypted web traffic now exceeds 90%

#160

Post by jsjohnst » Fri, Nov 01, 2019, 10:45 PM UTC

brycesbeard wrote: post #150

noitkjerh wrote: post #149

Earlier quoted context omitted.

Snowden was a factor, but not the only one: - CPUs didn't have hardware acceleration for encryption (AES-NI) like they have today, so activating SSL on your webserver actually decreased your throughput a lot - It was expensive and complicated to get a certificate for your website, now LetsEncrypt provides them freely and easily

Wasn’t the server load for ssl something like 3-5%? That doesn’t strike me as much of a factor as the complexity involved, especially with the confusion added by eg Thawte hawking their enhanced validation product.

> Wasn’t the server load for ssl something like 3-5%?

Depends on the packets per second being handled. I’ve pegged a CPU core easily doing encryption just a bit over a decade ago due to high data rate. If you’re pushing >500Mb/sec without CPU accelerated encryption (or NIC offloading) it puts a pretty hefty strain on resources.