Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why isn't HTTPS everywhere yet?

webappsec-test.info

Post reply on HN
Print view View original

21–30 of 130 posts

Re: Why isn't HTTPS everywhere yet?

#21

Post by thehairyone »

duskwuff wrote: post #9
thehairyone wrote: post #6

a2enmod headers echo -e "ServerSignature Off\nServerTokens Prod" >> /etc/apache2/apache2.conf /etc/init.d/apache2 restart openssl req -new -nodes -keyout webappsec-test.info.key -out webappsec-test.info.csr -newkey rsa:2048 cat webappsec-test.info.csr Register here: https://www.startssl.com/ Copy and paste csr... cat Domain_cert.pem CA_root.pem https://mozilla.github.io/server-side-tls/ssl-config-generat... ====> A+…

Why use StartSSL, when Let's Encrypt will give you an equally good certificate (with more flexibility on SANs!) with less hassle?

No, it doesn't.

Lets Encrypt certs are equivalent to self-signed certs.

No hassle ==> broken shit.

Re: Why isn't HTTPS everywhere yet?

#22

Post by Integer »

kefka wrote: post #14

Im not able to use SSL certs on all my endpoints. I have to use self-signed certs. That's because many of my machines are on TOR hidden services. The CA-CERT won't allow any certs for .onion unless you buy at exorbitant price an EV2 cert. And that especially means no free certs. So I do use self-signed because I want end to end crypto (and the next-to node can see data). Of course my browsers throw a fit, but alas I…

I always thought .onion sites are end to end encrypted. "The rendezvous point simply relays (end-to-end encrypted) messages from client to service and vice versa." according to https://www.torproject.org/docs/hidden-services.html.en There's even a ticket to add a padlock to indicate this in TOR Browser https://trac.torproject.org/projects/tor/ticket/8686

Re: Why isn't HTTPS everywhere yet?

#23

Post by vacri »

dangrossman wrote: post #20
hobarrera wrote: post #18

Earlier quoted context omitted.

> IPv4 addresses cost. Most big sites can't quite go SNI-only yet. Soon! Why can't they go SNI? It's not like IE6 or netscape are relevant any more, is there some other issue?

No SNI on Windows XP (IE6, IE7, IE8, Safari), nor Android 2.3 Browser, nor BlackBerry. Windows XP still has 4-5% usage share on the web, which is 1 in 20 people. Lots and lots of low-end and older Android handsets were on 2.3 because 4.0 had new hardware requirements. Combined, it's a relevant number of people for large sites.

> Windows XP still has 4-5% usage share on the web, which is 1 in 20 people.

Chrome and FF together have a market share of about 70%, so roughly speaking, only 30% of those XP users can be expected to still be using IE or safari. The percentage might be a touch higher as users left on XP might be less likely to use a different browser, but it's certainly not like all of today's XP users are on IE + Safari.

Re: Why isn't HTTPS everywhere yet?

#24

Post by unethical_ban »

thehairyone wrote: post #21
duskwuff wrote: post #9

Earlier quoted context omitted.

Why use StartSSL, when Let's Encrypt will give you an equally good certificate (with more flexibility on SANs!) with less hassle?

No, it doesn't. Lets Encrypt certs are equivalent to self-signed certs. No hassle ==> broken shit.

No, you are incorrect. At the moment, their certs are cross-signed, and I have tested my site with multiple browsers. It works.

Re: Why isn't HTTPS everywhere yet?

#25

Post by slachterman »

thehairyone wrote: post #21
duskwuff wrote: post #9

Earlier quoted context omitted.

Why use StartSSL, when Let's Encrypt will give you an equally good certificate (with more flexibility on SANs!) with less hassle?

No, it doesn't. Lets Encrypt certs are equivalent to self-signed certs. No hassle ==> broken shit.

I don't think that's correct per https://letsencrypt.org/certificates/

Our intermediate is signed by ISRG Root X1. However, since we are a very new certificate authority, ISRG Root X1 is not yet trusted in most browsers. In order to be broadly trusted right away, our intermediate is also cross-signed by another certificate authority, IdenTrust, whose root is already trusted in all major browsers. Specifically, IdenTrust has cross-signed our intermediate using their DST Root CA X3.

Re: Why isn't HTTPS everywhere yet?

#26

Post by d0ugie »

thehairyone wrote: post #6

a2enmod headers echo -e "ServerSignature Off\nServerTokens Prod" >> /etc/apache2/apache2.conf /etc/init.d/apache2 restart openssl req -new -nodes -keyout webappsec-test.info.key -out webappsec-test.info.csr -newkey rsa:2048 cat webappsec-test.info.csr Register here: https://www.startssl.com/ Copy and paste csr... cat Domain_cert.pem CA_root.pem https://mozilla.github.io/server-side-tls/ssl-config-generat... ====> A+…

Nice. Can you do the same trick for us, but for NGINX?

Re: Why isn't HTTPS everywhere yet?

#27

Post by ceejayoz »

thehairyone wrote: post #21
duskwuff wrote: post #9

Earlier quoted context omitted.

Why use StartSSL, when Let's Encrypt will give you an equally good certificate (with more flexibility on SANs!) with less hassle?

No, it doesn't. Lets Encrypt certs are equivalent to self-signed certs. No hassle ==> broken shit.

> Lets Encrypt certs are equivalent to self-signed certs.

This is entirely false.

Re: Why isn't HTTPS everywhere yet?

#28

Post by manigandham »

r1ch wrote: post #19

Still no mention about ads. Using HTTPS means you have to load ads over HTTPS and a huge number of ad networks are not reachable over HTTPS and another large number of assets / tags are hard coded to fetch HTTP resources. For any ad supported website, HTTPS will cause a significant loss of ad revenue. Given how long it's taking the industry to transition away from Flash I'm not holding my breath about this being fixe…

This is a big reason. Unfortunately the industry is full of old and/or poor tech that is already fragile as it is.

All modern ad networks (like ours) are completely HTTPS ready but the transition will be slow due to momentum with existing vendors.

Re: Why isn't HTTPS everywhere yet?

#29

Post by detaro »

dangrossman wrote: post #20
hobarrera wrote: post #18

Earlier quoted context omitted.

> IPv4 addresses cost. Most big sites can't quite go SNI-only yet. Soon! Why can't they go SNI? It's not like IE6 or netscape are relevant any more, is there some other issue?

No SNI on Windows XP (IE6, IE7, IE8, Safari), nor Android 2.3 Browser, nor BlackBerry. Windows XP still has 4-5% usage share on the web, which is 1 in 20 people. Lots and lots of low-end and older Android handsets were on 2.3 because 4.0 had new hardware requirements. Combined, it's a relevant number of people for large sites.

And highly dependent on the region and demographics of the visitors, so the numbers can be way higher (or way lower if you are lucky).

Re: Why isn't HTTPS everywhere yet?

#30

Post by detaro »

thehairyone wrote: post #21
duskwuff wrote: post #9

Earlier quoted context omitted.

Why use StartSSL, when Let's Encrypt will give you an equally good certificate (with more flexibility on SANs!) with less hassle?

No, it doesn't. Lets Encrypt certs are equivalent to self-signed certs. No hassle ==> broken shit.

You might want to share a few more details if you want those claims to be taken seriously.
Post reply on HN