Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS by default

security.googleblog.com

Post reply on HN
Print view View original

201–210 of 268 posts

Re: HTTPS by default

#201

Post by blitzar »

jve wrote: post #193
varjag wrote: post #184

Earlier quoted context omitted.

I call this the quicksand theory of network security. The threat is real but the risk overstated by orders of magnitude.

Remember firesheep? [1] [2] Go to a cafe with open WiFi, fire up extension and click on user who you want to impersonate. Now imagine if we still lived in a world like that. Someone visits UN meeting and the rest is your imagination. [1] https://nordvpn.com/cybersecurity/glossary/firesheep/?srslti... [2] https://en.wikipedia.org/wiki/Firesheep

I used to pick peoples email username and passwords off the network in starbucks.

Re: HTTPS by default

#202

Post by dns_snek »

kstrauser wrote: post #64
ndriscoll wrote: post #53

Earlier quoted context omitted.

You can already see what site someone visits with HTTPS. It's in the Client Hello, and is important for things like L4 load balancing (e.g. HAProxy can look at the host to choose what backend to forward the TCP packets for that connection to without terminating TLS). It's also important for network operators (e.g. you at home) to be able to filter unwanted traffic (e.g. Google's).

I don't think seeing the site is too important, although there are TLS extensions to encrypt that, too[0]. In practice, a huge chunk of sites still have unique IPs, so seeing that someone is connecting to 1.2.3.4 gives you a pretty good idea of what site they're visiting. That's even easier if they're using plaintext DNS (i.e. instead of DoH) so that you can correlate "dig -t a example.com => 1.2.3.4" followed immedi…

> But you still have plausible deniability to say "I was just looking at it so I could see how evil it was", rather than having to explain why you were checking out "/schedule-an-appointment".

TLS traffic analysis can still reveal which pages you accessed with some degree of confidence, based on packet sizes, timings, external resources that differ between pages (e.g. images)

Re: HTTPS by default

#203

Post by blitzar »

wingman-jr wrote: post #161
giobox wrote: post #133

Earlier quoted context omitted.

There is likely zero chance the OP's recollection is remotely correct. Pandora went public in 2011 with 80 million users, the chances of a publicly listed company of this size taking payments over HTTP in 2012 are about as close to zero as can be. If nothing else, their payment processor would drop them as a customer.

I found this: https://textslashplain.com/2016/03/06/using-https-properly/ Seems like it at least partially corroborates OP's recollection!

move fast break things

Re: HTTPS by default

#204

Post by bell-cot »

eadmund wrote: post #194
bell-cot wrote: post #185

Earlier quoted context omitted.

Sounds like a great argument for keeping js disabled in my browser. Because "httpS://" does nothing whatever to sanitize the js that it delivers. And one perfectly legit site may pull in js from two dozen or more different servers. Zero of which are magically guaranteed to only deliver benevolent code. Vs. `traceroute` suggests that would-be on-path attackers are up against a vastly smaller attack surface.

Ironically, this Google page itself fails to work without Javascript enabled!

Ironically? For maximum monetization, Google needs js, to turn "your" web browser into their web browser. https://news.ycombinator.com/item?id=42747092

Re: HTTPS by default

#205

Post by dns_snek »

bigstrat2003 wrote: post #59
kevstev wrote: post #25

Earlier quoted context omitted.

There are dozens of us I guess that care about this kind of thing. I have never really understood the obsession with https for static content that I don't care if anyone can see I am reading like a blog post. HTTPS should be for things that matter, everything else can, and think should use HTTP when it is not necessary. Depending on yet another third party to provide what is IMHO a luxury should not be required, and…

Agreed. I think that the push to make everything HTTPS is completely unnecessary, and in fact counterproductive to security. By throwing scary warnings in front of users when there is no actual security threat, we teach users that the scary warnings don't matter and they just should click past them. Warning when a site doesn't use TLS is a clear cut case of crying wolf.

> Warning when a site doesn't use TLS is a clear cut case of crying wolf.

No, it's a warning sign that you may be an active victim of an HTTPS downgrade attack where an attacker is blocking HTTPS communication and presenting you with an HTTP version of the website that you intended to visit, capturing and modifying any information you transmit and receive.

> By throwing scary warnings in front of users when there is no actual security threat

Most of these situations may be innocent but the problem is that they look identical to "actual security threats" so you don't have a choice. If there was a way to distinguish between them we/they would be doing it already.

Re: HTTPS by default

#206

Post by bombcar »

philipallstar wrote: post #190
Ajedi32 wrote: post #35

Earlier quoted context omitted.

Onion websites also don't need TLS (they have their own built-in encryption) so that solves the previous commenter's complaint too. Add in decentralized mesh networking and it might actually be possible to eliminate the dependency on an ISP too.

> they have their own built-in encryption What does this mean? Is that encryption not reliant on any third parties, or is it just relying on different third parties?

The onion URL is itself a public key - https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7... for example.

Proton Mail burned CPU time until they found a public key that started the way they wanted it to.

So that is the public key for an HTTPS equivalent as part of the tor protocol.

You can ALSO get an HTTPS certificate for an onion URL; a few providers offer it. But it’s not necessary for security - it does provide some additional verification (perhaps).

Re: HTTPS by default

#208

Post by dspillett »

tracker1 wrote: post #152
01HNNWZ0MV43FF wrote: post #121

Earlier quoted context omitted.

There are public logs of every TLS cert issued by the major providers. This benefits Google. Kinda like how Wikipedia benefits Google. Or public roads benefit Uber. Or clean water benefits restaurants

Google also knows about every domain name that gets renewed or registered... How does knowing a website has tls help in any meaningful way that would detract from society as a whole?

The certificate transparency log lets everyone know which domains are active as the certificates are getting renewed, likely more often than the domain itself, and also which sub-domains are active if those are not secured using a wild-card certificate.

Not just Google: AI bots could use the information to look for juicy new data to scrape and ingest.

Probably not a significant thing, the information can be derived in other ways too if someone wants to track these things, but it is a thing.

Re: HTTPS by default

#209

Post by dspillett »

sam_lowry_ wrote: post #55
kaoD wrote: post #40

Earlier quoted context omitted.

Just because you don't care doesn't mean nobody cares. I don't want anyone snooping on what I browse regardless of how "safe" someone thinks it is. My navigation habits are boring but they are mine , not anyone else's to see. A server has no way to know whether the user cares or not, so they are not in a position to choose the user's privacy preferences. Also: a page might be fully static, but I wouldn't want $GOVERN…

So... do you refuse to use the laptop supplied by your employer? It does MITM between you and the HTTPS websites you browse.

> So... do you refuse to use the laptop supplied by your employer?

For things other than work for my employer? Yes.

And work stuff doesn't touch my personal equipment, with the exception that I can connect to the company VPN from my personal laptop to remote to a work machine if I need to do DayJob work remote in an emergency when I don't have the company laptop with me.

> It does MITM between you and the HTTPS websites you browse.

My employer doesn't. Many don't.

Of course many do, but that is them controlling what happens on their equipment and they are usually up front about it. This is quite different to an ISP, shady WiFi operator, or other adversarial network node, inspecting and perhaps modifying what I look at behind my back.

Re: HTTPS by default

#210

Post by 1vuio0pswjnm7 »

1vuio0pswjnm7 wrote: post #151
vhcr wrote: post #21

Earlier quoted context omitted.

Depend on one less third party, you still depend on the DNS Root servers, your ISP / hosting, domain registry, etc.

Third party root servers are generally used for looking up TLD nameservers, not for looking up domainnames registered to individuals publishing personal blogs^1 Fortunately, one can publish on the www without using ICANN DNS For example http://199.233.217.201 or https://199.233.217.201 1. I have run own root server for over 15 years An individual cannot even mention choosing to publish a personal blog over HTTP witho…

Definition of "root server"

Authoritative DNS nameserver that serves root.zone, e.g., the one provided by ICANN, or maybe a customised one

In own case it is served only to me on local network

Many years ago, one of the former ICANN board members mentioned on his personal blog running his own root

Post reply on HN