Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS by default

security.googleblog.com

Post reply on HN
Print view View original

181–190 of 268 posts

Re: HTTPS by default

#181

Post by varjag »

derf_ wrote: post #136
kevstev wrote: post #25

Earlier quoted context omitted.

There are dozens of us I guess that care about this kind of thing. I have never really understood the obsession with https for static content that I don't care if anyone can see I am reading like a blog post. HTTPS should be for things that matter, everything else can, and think should use HTTP when it is not necessary. Depending on yet another third party to provide what is IMHO a luxury should not be required, and…

>There are dozens of us I guess... Shine on you crazy diamond, and all that, but... > I have been continually confused as to why it is being forced down everyone's throat. Have you never sat on public wifi and tried to open an http site? These days it is highly likely to be MITM'd by the wifi provider to inject ads (or worse). Even residential ISPs that one pays for cannot be trusted not to inject content, if given t…

Have you never sat on public wifi and tried to open an http site? These days it is highly likely to be MITM'd by the wifi provider to inject ads (or worse).

I honestly don't remember a single case where that happened to me. Internet user since 1997.

Re: HTTPS by default

#182

Post by [deleted] »

MrJohz wrote: post #163
array_key_first wrote: post #111

Earlier quoted context omitted.

> There are still legitimate uses for HTTP including reading static content. This can still be MITM'd. Maybe they can't drain your bank account by the nature of the content, but they can still lie or something. And that's not good.

Or more problematically, inject a bunch of ads that lead users on to scams. It would be ideal if people only browsed from trusted networks, but telling people "don't do the convenient, useful, obvious thing" only goes so far. Hence the desire to secure connections from another angle.

[deleted]

Re: HTTPS by default

#183

Post by [deleted] »

IgorPartola wrote: post #26

I distinctly remember trying to sign up for Pandora’s premium plan back in 2012 and their credit card form being served and processed over HTTP. I emailed them telling them that I wanted to give them my money if they would just fix the form. They never got back to me or fix it for several more years while I gave my money to Spotify. Back then HTTPS was NOT the norm and it was a battle to switch people to it. Yes it i…

[deleted]

Re: HTTPS by default

#184

Post by varjag »

Arainach wrote: post #83
isodev wrote: post #74

Earlier quoted context omitted.

While Google and friends are happy to push for https, it’s dramatically easier to scam people via ads or AI generated content. Claiming plain HTTP is scary seems like a straw man tbh

The threat model of HTTP isn't site owners, it's that anyone else can change the content and you can't tell that it didn't come from the original site. It's not a strawman, it's a real attack that we've seen for decades. The entire guidance of "don't connect to an open wireless AP"? That's because a malicious actor who controlled the AP could read and modify your HTTP traffic - inject ads, read your passwords, update…

I call this the quicksand theory of network security. The threat is real but the risk overstated by orders of magnitude.

Re: HTTPS by default

#185

Post by bell-cot »

throw_a_grenade wrote: post #175
cowl wrote: post #174

This is to be honest a little unfortunate. While Https is very important, do we really need to verify that Blog X that I may read once a year is really who they say they are? For many sites it doesn't make a lot of sense but we are here due to human nature

The problem is not the site, but the network in the middle. On-path attackers typically don't care about which site they MITM in order to inject javascript e.g. to show ads, insert tracking tokens or hijack the browser for other purposes. The site is the vector, not the target.

Sounds like a great argument for keeping js disabled in my browser. Because "httpS://" does nothing whatever to sanitize the js that it delivers. And one perfectly legit site may pull in js from two dozen or more different servers. Zero of which are magically guaranteed to only deliver benevolent code.

Vs. `traceroute` suggests that would-be on-path attackers are up against a vastly smaller attack surface.

Re: HTTPS by default

#186

Post by tialaramex »

michaelt wrote: post #179
Uvix wrote: post #110

Earlier quoted context omitted.

CAs have to follow the baseline rules set by Google and Mozilla regarding incident response timelines. If they gave you more time, the browsers would drop them as a supported CA.

The CAs have to follow the baseline rules set by the CA/Browser Forum which CAs are voting members of . Mark my words, some day soon an enterprising politician will notice the CA system can be drawn into trade sanctions against the enemy of the day....

The BRs already have a deliberate carve out where a CA can notify that their government requires them to break the rules and how they'll do that, and then the browsers, on behalf of relying parties can take whatever action they deem appropriate.

If you're required to (or choose to) not tell us about it, because of active monitoring when we notice it's likely your CA will be distrusted for not telling us, this is easier because there's a mechanism to tell us about it - same way that there's a way to officially notify the US that you're a spy, so, when you don't (because duh you're a spy) you're screwed 'cos you didn't follow the rules.

The tech centralization under the US government does mean there's a vulnerability on the browser side, but I wouldn't speculate about how long that would last if there's a big problem.

Re: HTTPS by default

#187

Post by bell-cot »

throawayonthe wrote: post #171
sam_lowry_ wrote: post #12

Earlier quoted context omitted.

I run my blog in unencrypted HTTP/1.1 just to make a point that we do not have to depend on third parties to publish content online. And I noticed that Whatsapp is even worse than Chrome, it opens HTTPS even if I share HTTP links.

why not make the point with at least a self signed cert?

99% of visitors wouldn't get the intended point - they'd think he's pro-cert, but forgot to renew it or something.

Re: HTTPS by default

#189

Post by austin-cheney »

The only challenge to https, as compared to http, is certificates. If not for certificates I could roll out a server with https absolutely anywhere in seconds including localhost and internal intranets.

On another note I would much prefer to skip https, as the default, and go straight to WSS (TLS WebSockets). WebSockets are superior to HTTP in absolutely every regard except that HTTP is session-less.

Re: HTTPS by default

#190

Post by philipallstar »

Ajedi32 wrote: post #35
MYEUHD wrote: post #33

Earlier quoted context omitted.

Host an onion website at home using solar energy, and the only third party your website will depend on is your internet provider :)

Onion websites also don't need TLS (they have their own built-in encryption) so that solves the previous commenter's complaint too. Add in decentralized mesh networking and it might actually be possible to eliminate the dependency on an ISP too.

> they have their own built-in encryption

What does this mean? Is that encryption not reliant on any third parties, or is it just relying on different third parties?

Post reply on HN