Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Switch to HTTPS Now, For Free

konklone.com

Post reply on HN
Print view View original

201–210 of 264 posts

Re: Switch to HTTPS Now, For Free

#201

Post by wglb »

elchief wrote: post #167
espeed wrote: post #59

Make sure you do not use compression with SSL. Using compression with SSL could make your site vulnerable to the CRIME and BREACH attacks. See... SSL Gone in 30 Seconds - A BREACH Beyond CRIME [video]: http://www.youtube.com/watch?v=pIKIXQNFplY&hd=1 BREACH Attack (HTTP Compression): http://breachattack.com , http://security.stackexchange.com/questions/39925/breach-a-n... CRIME Attack (SSL/TLS/SPDY Compression): http:…

Don't use HTTP compression on private responses when using TLS. It's okay to HTTP compress publicly available images/scripts/stylesheets

Well, be careful that it is just the body that gets compressed.

The vulnerability occurs when the cookie is part of the compression payload. Although that does depend on the attacker being able to control what gets sent.

Re: Switch to HTTPS Now, For Free

#202

Post by makomk »

Zoepfli wrote: post #150
cpeterso wrote: post #77

Earlier quoted context omitted.

Note that Wikipedia supports HTTPS, but it is not the default (yet).

Funny, it is for me: any wikipedia page redirects to its https counterpart. E.g. http://en.wikipedia.org/wiki/Hacker_News redirects to https://en.wikipedia.org/wiki/Hacker_News .

Do you have a user account at Wikipedia by any chance? They've been redirecting logged-in users to the SSL version for a while, and under some circumstances it also seems to redirect users who have been logged in but aren't right now.

Re: Switch to HTTPS Now, For Free

#203

Post by makomk »

GoodIntentions wrote: post #161
mmagin wrote: post #132

Earlier quoted context omitted.

That's dumb. If you're going to install a new root certificate on all your client machines, you could just as well generate your own CA inside your organization and do the same thing without trusting some third party. (Edit: I think I've been trolled.)

Ya Think? "Self-signed certs as a service! IN THE CLOUD! Need Support for your self-signed cert? 5k/year - 1 (800) 555 - 5549" I wonder if they have an affiliate program

They've got something better - anyone can download a copy of the signing key and set up their own unofficial LOLroot affiliate.

Re: Switch to HTTPS Now, For Free

#204

Post by mike-cardwell »

__david__ wrote: post #92
ewolf wrote: post #4

Are there any downsides to these free certs? Do they work in all browsers; is there anything that could be better security-wise? If not, than this is exactly what we need to establish HTTPS as the new standard.

They do not work on Windows XP (unless the user is using Firefox or Chrome), as the StartCom certificate is not part of the XP trusted root certs. There is an update available from Microsoft to add some new root certs but as far as I can tell it is a manual only update, which means it's very unlikely to be installed by XP users. We tried to switch our site to https only recently, and had to backtrack because of this…

StartSSL is wide spread enough that anyone who doesn't have their root installed is probably used to clicking their way through SSL warnings anyway.

Re: Switch to HTTPS Now, For Free

#205

Post by mike-cardwell »

kijin wrote: post #149

If you don't have a dedicated IP for each domain, and if you need to support clients who can't use SNI (IE on Windows XP, Android 2.x, etc.), here's a simple solution: Use a different port number. https://example-domain.com:12345/ is a completely different website from https://another-domain-on-same-ip:32412/ . No need for a dedicated IP address. No need for wildcard certs, SNI, or any of that fancy stuff. Sure, it's…

A lot of corporate networks only allow machines to connect outwards on a certain whitelisted range of ports, ie 80 and 443. A certificate warning for ancient clients because you're using SNI is a much better failure mode than a connection error.

Re: Switch to HTTPS Now, For Free

#206

Post by pantaril »

majelix wrote: post #197
victorf wrote: post #151

Earlier quoted context omitted.

Do you not feel that, due to the security failure in 2011, they are one of the worst? I typically disable their certificate on my machines. The CA system is totally flawed anyway, I don't know why I bother.

> The CA system is totally flawed anyway The flaw basically being that people aren't trustworthy, yes? Do you have any alternatives? There's ssh's model, where you just hope it's the right certificate the first time; or maybe mob-source it like WoT?

There are flaws with current PKI infrastructure but as you say, it's better than nothing. There are also several initiatives to improve this situation. Google has come with certificate transparency ( http://www.certificate-transparency.org/ ) which essentialy creates public log of all issued certificates so everyone can see and verify that certificates authorities don't issue bogus/fake certificates

There is also an idea to use proof of work to estabilish network-wide consensus about valid certificates (like bitcoin or namecoin blockchain). This would be fully decentralised solution.

Re: Switch to HTTPS Now, For Free

#207

Post by cpncrunch »

elchief wrote: post #168
cpncrunch wrote: post #137

Earlier quoted context omitted.

Nope, you can use it for a company as well.

If you read their terms, and I have, you definitely can't use the free certs for shopping or banking sites. It's kind of vague as to whether you can use it for a commercial site that doesn't involve shopping or banking though.

I did read their terms, which is why I posted that. Nowhere does it say that you can't use the free certificate for a company. In fact if you read their FAQ ("The certificate is for my company, what shall I do?") it says "even in case he/she decides to obtain certification as an employee or representative of an organization". So it is specifically saying that you can use it for a company website.

Also it doesn't say in policy.pdf that you can't use it for banking. It just says you can't have a subdomain with the word "bank" or similar in it. So you could use the free certificate for an online bank, although it's probably not the best idea :)

Please don't downvote me just because you didn't read the terms properly. My comment above was correct.

Re: Switch to HTTPS Now, For Free

#209

Post by alextingle »

Tichy wrote: post #194
alextingle wrote: post #180

Earlier quoted context omitted.

/etc/hosts... # Screw Google... 127.0.0.1 www.google-analytics.com 127.0.0.1 ssl.google-analytics.com

Are you sure they only use one domain? Perhaps for analytics, but there is also adsense, doubleclick and who knows what else.

I don't mind adsense, and if I did, there's always AdBlock. No, analytics was annoying me because of page load time. The number of times my browser stopped loading because "waiting for google-analytics.com" got me wound up enough one day to just block them for good.
Post reply on HN