Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Still Why No HTTPS?

troyhunt.com

Post reply on HN
Print view View original

181–190 of 345 posts

Re: Still Why No HTTPS?

#181

Post by [deleted] »

cesarb wrote: post #164
dm33tri wrote: post #144

Why do browsers punish non-verified certs much harder than no-cert? If I want to quickly host my page and use encryption, then I have go through all that hustle to make it work. Perhaps allow use of self-signed certificates on same level as http instead of blocking my website.

Since there's no way to distinguish a non-verified (self-signed or not) certificate from an attack, browsers have to treat them identically to an attack (otherwise an attacker would simply pretend to be a non-verified certificate, to get the more lenient treatment). On the other hand, a no-cert (unencrypted) connection can be distinguished from an attack on an encrypted connection: the browser knows a priori (through…

[deleted]

Re: Still Why No HTTPS?

#182

Post by strenholme »

namibj wrote: post #172
strenholme wrote: post #171

One annoyance with this system, from the linked webpage: >an expectation that a site responds to an HTTP request over the insecure scheme with either a 301 or 302 Doing things this way is the final nail in the coffin for Internet Explorer 6, since IE6 does not use any version of SSL which is considered secure here in 2019. And, yes, I have seen in people the real world still using ancient Internet Explorer 6 as recen…

Be aware that blocking scripts from insecure connections is something you'd usually want to do...

“usually” being the operative word. I’m not quite ready to throw IE6 (Internet Explorer 6) and all http-only browsers completely under a bus yet.

Re: Still Why No HTTPS?

#183

Post by lucideer »

cesarb wrote: post #164
dm33tri wrote: post #144

Why do browsers punish non-verified certs much harder than no-cert? If I want to quickly host my page and use encryption, then I have go through all that hustle to make it work. Perhaps allow use of self-signed certificates on same level as http instead of blocking my website.

Since there's no way to distinguish a non-verified (self-signed or not) certificate from an attack, browsers have to treat them identically to an attack (otherwise an attacker would simply pretend to be a non-verified certificate, to get the more lenient treatment). On the other hand, a no-cert (unencrypted) connection can be distinguished from an attack on an encrypted connection: the browser knows a priori (through…

I think the point here is that there's also no way to distinguish a http request from an attack.

It's fair enough to an argue that a self-signed cert could be an attack, but so could any http request.

> a no-cert (unencrypted) connection can be distinguished from an attack on an encrypted connection: the browser knows a priori (through the protocol in the URL) that the connection is supposed to be unencrypted.

I don't understand how that allows one to distinguish it from an attack. Knowing that a connection is supposed to be unencrypted is just equivalent to knowing that a connection could be under attack.

Re: Still Why No HTTPS?

#184

Post by namibj »

ATsch wrote: post #69
namibj wrote: post #27

There is one "good" reason against https: handshakes take enormous amounts of CPU, relatively speaking. It's quite easy tp DoS server by skipping the expensive part on your end. You can load a core with 10~30Mbit@2k rps if your not even optimized. Whereas the same server could tank 40k rps HTTP requests.

If this is true, how do you explain the lack of any notable L7 TLS DoS attacks?

People throwing up CDNs and dumb bandwith blasting often being easier?

Re: Still Why No HTTPS?

#185

Post by AndrewStephens »

enriquto wrote: post #128
WilliamEdward wrote: post #4

Some websites adamantly insist they did not need HTTPS because they are purely static. https://www.troyhunt.com/heres-why-your-static-website-needs... The same website to my surprise has an article on why this is faulty reasoning.

my static website is a sand castle in the beach. When I'm not around, kids may break it, or a random person may impersonate as its creator. That is alright, it is just a sand castle. The only purpose of its existence is to provide casual onlookers a nice view (or read) for a few minutes. Having to set up a "certificate" for that would be an unacceptable burden.

It is a sand castle on a private beach owned by you.

Have you ever posted a link to your site anywhere? Imagine you sent me a post card saying "Come to my beach to look at my cool sandcastle" and then when I got there the sandcastle was actually a robot that stole my credit card.

You could say that it wasn't your fault - somebody broke into your private beach and replaced the sandcastle.

But I would probably still blame you for not securing the area and double-checking the contents before inviting people. Even if I didn't blame you, I probably wouldn't respond to another invitation.

Re: Still Why No HTTPS?

#186

Post by AndrewStephens »

iudqnolq wrote: post #22
WilliamEdward wrote: post #4

Some websites adamantly insist they did not need HTTPS because they are purely static. https://www.troyhunt.com/heres-why-your-static-website-needs... The same website to my surprise has an article on why this is faulty reasoning.

Our asshat twin n-gate has something to say about this > Horseshit. Users must keep themselves safe. Software can't ever do that for you. Users are on their own to ensure they use a quality web client, on a computer they're reasonably sure is well-maintained, over an internet connection that is not run by people who hate them. None of the packets I send out are unsafe, so my site does not need HTTPS. > None of those…

I enjoy n-gate but they are completely wrong on HTTPS.

That part about the web ad industry is entirely correct.

Re: Still Why No HTTPS?

#187

Post by Liquid_Fire »

dijit wrote: post #179
Liquid_Fire wrote: post #143

Earlier quoted context omitted.

HTTPS will protect you against hijacked DNS requests as well.

Not by itself, if you have special HTTP headers it will. But some of those are deprecated (HPKP; for example)[0] [0]: https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning#Browse...

If you hijack the DNS request and respond with the IP of a different server, that server will not have a valid certificate for the domain in question. Why are any extra features required?

Re: Still Why No HTTPS?

#188

Post by Wingy »

strenholme wrote: post #171

One annoyance with this system, from the linked webpage: >an expectation that a site responds to an HTTP request over the insecure scheme with either a 301 or 302 Doing things this way is the final nail in the coffin for Internet Explorer 6, since IE6 does not use any version of SSL which is considered secure here in 2019. And, yes, I have seen in people the real world still using ancient Internet Explorer 6 as recen…

Why not look at the User-Agent header and 301 to https if you don't see IE6?

Re: Still Why No HTTPS?

#189

Post by fiatjaf »

Because it's hard and a pain.

Sure, depending on your setup it's easy, but for a lot of setups it isn't. Instead of trying to say HTTPS is easy and shame everybody who isn't doing it more efforts should be diverted into creating an actual fully encrypted network that doesn't need CAs.

Re: Still Why No HTTPS?

#190

Post by vbezhenar »

strenholme wrote: post #171

One annoyance with this system, from the linked webpage: >an expectation that a site responds to an HTTP request over the insecure scheme with either a 301 or 302 Doing things this way is the final nail in the coffin for Internet Explorer 6, since IE6 does not use any version of SSL which is considered secure here in 2019. And, yes, I have seen in people the real world still using ancient Internet Explorer 6 as recen…

Can you use old crypto for IE6 using some kind of agent detection while using new crypto for modern browsers? I thought Cloudflare does something like that. But there's a danger of MITM downgrade attack with this approach...
Post reply on HN