Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS by default

security.googleblog.com

Post reply on HN
Print view View original

161–170 of 268 posts

Re: HTTPS by default

#161

Post by wingman-jr »

giobox wrote: post #133
fuzzzerd wrote: post #38

Earlier quoted context omitted.

I remember even back in the early 2000s https for credit card forms was pretty common. Surprised a company like Pandora wasn't with it by thr 2010s.

There is likely zero chance the OP's recollection is remotely correct. Pandora went public in 2011 with 80 million users, the chances of a publicly listed company of this size taking payments over HTTP in 2012 are about as close to zero as can be. If nothing else, their payment processor would drop them as a customer.

I found this: https://textslashplain.com/2016/03/06/using-https-properly/ Seems like it at least partially corroborates OP's recollection!

Re: HTTPS by default

#162

Post by [deleted] »

JakaJancar wrote: post #160
1vuio0pswjnm7 wrote: post #151

Earlier quoted context omitted.

Third party root servers are generally used for looking up TLD nameservers, not for looking up domainnames registered to individuals publishing personal blogs^1 Fortunately, one can publish on the www without using ICANN DNS For example http://199.233.217.201 or https://199.233.217.201 1. I have run own root server for over 15 years An individual cannot even mention choosing to publish a personal blog over HTTP witho…

You have some weird definition of "root".

[deleted]

Re: HTTPS by default

#163

Post by MrJohz »

array_key_first wrote: post #111
isodev wrote: post #86

Earlier quoted context omitted.

Then perhaps the problem is open APs? There are still legitimate uses for HTTP including reading static content. Say we all move to HTTPS but then let’s encrypt goes away, certificate authority corps merge, and then google decides they also want remote attestation for two way trust or whatever - the whole world becomes walled up into an iOS situation. Even a good idea is potentially very bad at the hands of unregulat…

> There are still legitimate uses for HTTP including reading static content. This can still be MITM'd. Maybe they can't drain your bank account by the nature of the content, but they can still lie or something. And that's not good.

Or more problematically, inject a bunch of ads that lead users on to scams.

It would be ideal if people only browsed from trusted networks, but telling people "don't do the convenient, useful, obvious thing" only goes so far. Hence the desire to secure connections from another angle.

Re: HTTPS by default

#164

Post by philippta »

While this is great for end users, this just shows again what kind of monopoly Google has over the web by owning Chrome.

I work at a company that also happens to run a CDN and the sheer amount of layers Google forces everyone to put onto their stack, which was a very simple text based protocol, is mind boggling.

First there was simple TCP+HTTP. Then HTTPS came around, adding a lot of CPU load onto servers. Then they invented SPDY which became HTTP2, because websites exploded in asset use (mostly JS). Then they reinvented the layer 4 with QUIC (in-house first), which resulted in HTTP3. Now this.

Each of them adding more complexity and data framing onto, what used to be a simple message/file exchange protocol.

And you can not opt out, because customers put their websites into a website checker and want to see all green traffic lights.

Re: HTTPS by default

#165

Post by Traubenfuchs »

I for one hate https. Some html5 apis like location do not work without it and you get big fat warnings if you don‘t use it.

From having to pay for it in the past to now having to set up lets-encrypt, certbot, https-ingresses!

God, half my hobbyist and raw non-helm kubernetes config is https related. https-ingress.yaml is gigantic!

Is this really the best devex we could come up with?

Re: HTTPS by default

#166

Post by bawolff »

MYEUHD wrote: post #33
vhcr wrote: post #21

Earlier quoted context omitted.

Depend on one less third party, you still depend on the DNS Root servers, your ISP / hosting, domain registry, etc.

Host an onion website at home using solar energy, and the only third party your website will depend on is your internet provider :)

What about the Tor directory authorities?

There is no magic do it all yourself. Communicating with people implies dependence.

Re: HTTPS by default

#167

Post by bawolff »

shadowgovt wrote: post #16
sam_lowry_ wrote: post #12

Earlier quoted context omitted.

I run my blog in unencrypted HTTP/1.1 just to make a point that we do not have to depend on third parties to publish content online. And I noticed that Whatsapp is even worse than Chrome, it opens HTTPS even if I share HTTP links.

Doesn't that mean that technically, any node in the network between you and your reader can mutate the contents of the blog in-transit without anyone being the wiser (up to and including arbitrary JavaScript inline injection)? Probably a low-threat security risk for a blog.

For a blog, i think the bigger risk is pervasive surveilence - gov reads all the connections and puts you on a list if the thing you are reading has the wrong keyword in it.

Re: HTTPS by default

#168

Post by dns_snek »

shadowgovt wrote: post #37
sam_lowry_ wrote: post #28

Earlier quoted context omitted.

I'd be happy if EU outlawed this instead of outlawing encryption. But indeed, the ability to publish on my own outweights the risk of someone modding my content. Most of us here read their news from work laptops, where the employer and their MiTM supplier are a much bigger threat even for HTTPS websites.

This puts the question into my brain, which I have never thought to pursue, of whether you could offer a self-signed cert that the user has to install for HTTPS. Their client will complain loudly until and unless they install it, but then for those who care you could offer the best of both worlds. Almost certainly more trouble than it's worth. G'ah, and me without any free time to pursue a weekend hobby project!

> for those who care you could offer the best of both worlds.

You're not really offering that because the first connection could've be intercepted.

Re: HTTPS by default

#169

Post by graynk »

sam_lowry_ wrote: post #63
ozim wrote: post #61

Earlier quoted context omitted.

You just clearly don’t understand it is important that no one injects anything into your code while I am browsing it. With http it is trivial. So you say you don’t care if my ISP injects whole bunch of ads and I don’t even see your content but only the ads and I blame you for duping me into watching them. Nowadays VPN providers are popular what if someone buys VPN service from the shitty ones and gets treated like I…

My ISP does not and if yours does, vote with your money or lobby your government to make this illegal. And while at it, lobby to make corporate MiTM tools illegal as well. Because if you are bothered about my little blog, you should be bothered that your employer can inspect all your HTTPS traffic.

Or you could do a much simpler thing and support HTTPS and not expect users to change ISPs (which is not always possible, e.g. in rural areas) or change laws (which is even less realistic) to browse your (or any other) blog. Injecting ads has nothing to do with corporate MITM, it's unquestionably bad, but unrelated here.

More to the point: serving your blog with HTTPS via Let's Encrypt does not in any way forbid you from also serving it with HTTP without "depending on third parties to publish content online". It would take away from the drama of the statement though, I suppose.

Re: HTTPS by default

#170

Post by dns_snek »

sam_lowry_ wrote: post #63
ozim wrote: post #61

Earlier quoted context omitted.

You just clearly don’t understand it is important that no one injects anything into your code while I am browsing it. With http it is trivial. So you say you don’t care if my ISP injects whole bunch of ads and I don’t even see your content but only the ads and I blame you for duping me into watching them. Nowadays VPN providers are popular what if someone buys VPN service from the shitty ones and gets treated like I…

My ISP does not and if yours does, vote with your money or lobby your government to make this illegal. And while at it, lobby to make corporate MiTM tools illegal as well. Because if you are bothered about my little blog, you should be bothered that your employer can inspect all your HTTPS traffic.

It's not just your ISP, it's anyone on the entire network path, and on most networks with average security that includes any device on your local network.
Post reply on HN