Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS by default

security.googleblog.com

Post reply on HN
Print view View original

171–180 of 268 posts

Re: HTTPS by default

#171

Post by throawayonthe »

sam_lowry_ wrote: post #12
tialaramex wrote: post #7

I have had HTTPS-by-default for years and I can say that we're past the point where there's noticeable year-to-year change for which sites aren't HTTPS. It's almost always old stuff that pre-dates Let's Encrypt (and presumably just nobody ever added HTTPS). The news site which stopped updating in 2007, the blog somebody last posted to in 2011, that sort of thing. I think it's important to emphasise that although Tim'…

I run my blog in unencrypted HTTP/1.1 just to make a point that we do not have to depend on third parties to publish content online. And I noticed that Whatsapp is even worse than Chrome, it opens HTTPS even if I share HTTP links.

why not make the point with at least a self signed cert?

Re: HTTPS by default

#172

Post by 1313ed01 »

minitech wrote: post #146
bo1024 wrote: post #115

> What's worse, many plaintext HTTP connections today are entirely invisible to users, as HTTP sites may immediately redirect to HTTPS sites. That gives users no opportunity to see Chrome's "Not Secure" URL bar warnings after the risk has occurred, and no opportunity to keep themselves safe in the first place. What is the risk exactly? A man-in-the-middle redirect to a malicious https site?

Yes, that. Could be to a lookalike domain name, for example.

HTTPS sadly offers no protection from that at all these days. At least in the past when something was HTTPS you knew that someone had to jump through some hoops and pay some real money to earn that padlock, but now any script kiddie can automate certificates for free for as many lookalike domains they want to.

It would be nice to see some way for browsers to indicate when a site has some extra validation so you could immediately see that your bank has a real certificate as is appropriate for a bank and not just Let's Encrypt. Yes, I can click the padlock icon to get that information, but it would be nice if there was some light warning for free certificates to make it more immediately obvious.

Re: HTTPS by default

#173

Post by JoshTriplett »

1vuio0pswjnm7 wrote: post #151
vhcr wrote: post #21

Earlier quoted context omitted.

Depend on one less third party, you still depend on the DNS Root servers, your ISP / hosting, domain registry, etc.

Third party root servers are generally used for looking up TLD nameservers, not for looking up domainnames registered to individuals publishing personal blogs^1 Fortunately, one can publish on the www without using ICANN DNS For example http://199.233.217.201 or https://199.233.217.201 1. I have run own root server for over 15 years An individual cannot even mention choosing to publish a personal blog over HTTP witho…

> inane blather

And this is why it's a good thing that every major browser will make it more and more painful, precisely so that instead of arguments about it, we'll just have people deciding whether they want their sites accessible by others or not.

Unencrypted protocols are being successfully deprecated.

Re: HTTPS by default

#174

Post by cowl »

This is to be honest a little unfortunate. While Https is very important, do we really need to verify that Blog X that I may read once a year is really who they say they are? For many sites it doesn't make a lot of sense but we are here due to human nature

Re: HTTPS by default

#175

Post by throw_a_grenade »

cowl wrote: post #174

This is to be honest a little unfortunate. While Https is very important, do we really need to verify that Blog X that I may read once a year is really who they say they are? For many sites it doesn't make a lot of sense but we are here due to human nature

The problem is not the site, but the network in the middle. On-path attackers typically don't care about which site they MITM in order to inject javascript e.g. to show ads, insert tracking tokens or hijack the browser for other purposes. The site is the vector, not the target.

Re: HTTPS by default

#176

Post by sam_lowry_ »

derf_ wrote: post #136
kevstev wrote: post #25

Earlier quoted context omitted.

There are dozens of us I guess that care about this kind of thing. I have never really understood the obsession with https for static content that I don't care if anyone can see I am reading like a blog post. HTTPS should be for things that matter, everything else can, and think should use HTTP when it is not necessary. Depending on yet another third party to provide what is IMHO a luxury should not be required, and…

>There are dozens of us I guess... Shine on you crazy diamond, and all that, but... > I have been continually confused as to why it is being forced down everyone's throat. Have you never sat on public wifi and tried to open an http site? These days it is highly likely to be MITM'd by the wifi provider to inject ads (or worse). Even residential ISPs that one pays for cannot be trusted not to inject content, if given t…

Have you ever opened your work laptop? It is likely MITM'd so that your employer can see everything you read and post on the internet and HTTPS won't help you.

Re: HTTPS by default

#177

Post by homebrewer »

kevstev wrote: post #25
sam_lowry_ wrote: post #12

Earlier quoted context omitted.

I run my blog in unencrypted HTTP/1.1 just to make a point that we do not have to depend on third parties to publish content online. And I noticed that Whatsapp is even worse than Chrome, it opens HTTPS even if I share HTTP links.

There are dozens of us I guess that care about this kind of thing. I have never really understood the obsession with https for static content that I don't care if anyone can see I am reading like a blog post. HTTPS should be for things that matter, everything else can, and think should use HTTP when it is not necessary. Depending on yet another third party to provide what is IMHO a luxury should not be required, and…

Which blog post? If it's anything remotely political or controversial, people have disappeared for that. You can always spot someone on HN who has never stepped outside their cushy life in a liberal democracy. The difference in mentality — between how "you" and "we" see the world — is crazy.

Re: HTTPS by default

#178

Post by michaelt »

Dylan16807 wrote: post #134
michaelt wrote: post #88

Earlier quoted context omitted.

CAs are uniquely assertive about their right to cut off your access. My hosting provider may accidentally fuck up, but they'll apologise and fix it. My CA fucks up, they e-mail me at 7pm telling me I've got to fix their fuck-up for them by jumping through a bunch of hoops they have erected, and they'll only give me 16 hours to do it. Of course, you might argue my hosting provider has a much higher chance of fucking u…

So what does "CA fixes the problem" look like in your head? Because they'll give you a new certificate right away. You have to install it, but you can automate that, and it's hard to imagine any way they could help that would be better than automation. What else do you want them to do? Asking them to not revoke incorrect or compromised certificates isn't good for maintaining security.

Imagine if, hypothetically speaking, the CA had given you a certificate based on a DNS-01 challenge, but when generating and validating the challenge record they'd forgotten to prefix it with an underscore. Which could have lead to a a certificate being issued to the wrong person if your website was a service like dyndns that lets users create custom subdomains.

Except (a) your website doesn't let users create custom subdomains; (b) as the certificate is now in use, you the certificate holder have demonstrated control over the web server as surely as a HTTP-01 challenge would; (c) you have accounts and contracts and payment information all confirming you are who you say you are; and (d) there is no suggestion whatsoever that the certificate was issued to the wrong person.

And you could have gotten a certificate for free from Lets Encrypt, if you had automatic certificate rotation in place - you paid $500 for a 12-month certificate because you don't.

An organisation with common sense policies might not need to revoke such a certificate at all, let alone revoke it with only hours of notice.

Re: HTTPS by default

#179

Post by michaelt »

Uvix wrote: post #110
michaelt wrote: post #88

Earlier quoted context omitted.

CAs are uniquely assertive about their right to cut off your access. My hosting provider may accidentally fuck up, but they'll apologise and fix it. My CA fucks up, they e-mail me at 7pm telling me I've got to fix their fuck-up for them by jumping through a bunch of hoops they have erected, and they'll only give me 16 hours to do it. Of course, you might argue my hosting provider has a much higher chance of fucking u…

CAs have to follow the baseline rules set by Google and Mozilla regarding incident response timelines. If they gave you more time, the browsers would drop them as a supported CA.

The CAs have to follow the baseline rules set by the CA/Browser Forum which CAs are voting members of.

Mark my words, some day soon an enterprising politician will notice the CA system can be drawn into trade sanctions against the enemy of the day....

Re: HTTPS by default

#180

Post by Dylan16807 »

michaelt wrote: post #178
Dylan16807 wrote: post #134

Earlier quoted context omitted.

So what does "CA fixes the problem" look like in your head? Because they'll give you a new certificate right away. You have to install it, but you can automate that, and it's hard to imagine any way they could help that would be better than automation. What else do you want them to do? Asking them to not revoke incorrect or compromised certificates isn't good for maintaining security.

Imagine if, hypothetically speaking, the CA had given you a certificate based on a DNS-01 challenge, but when generating and validating the challenge record they'd forgotten to prefix it with an underscore. Which could have lead to a a certificate being issued to the wrong person if your website was a service like dyndns that lets users create custom subdomains. Except (a) your website doesn't let users create custom…

You didn't answer my question. What would the CA fixing it look like? Your hosting example had the company fix problems, not ignore them.

And have you seen how many actual security problems CAs have refused to revoke in the last few years? Holding them to their agreements is important, even if a specific mistake isn't a security problem [for specific clients]. Letting them haggle over the security impact of every mistake is much more hassle than it's worth.

> if you had automatic certificate rotation in place - you paid $500 for a 12-month certificate because you don't

Then in this hypothetical I made a mistake and I should fix it for next time.

And I should be pretty mad at my CA for giving me an invalid certificate. Was there an SLA?

Post reply on HN