Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deprecating Non-Secure HTTP

blog.mozilla.org

Post reply on HN
Print view View original

201–210 of 318 posts

Re: Deprecating Non-Secure HTTP

#201

Post by Too »

cdnsteve wrote: post #56

I have to say, I actually disagree with this move. While I think the intentions sound noble, and I'm all for a more secure web, I also believe that a web browser has no business dictating that the entire web should be forced in HTTPs. I don't see any benefit in this type of blanket, all or nothing, type of approach. In fact, I see it doing more damage than good. Encrypting blogs, news websites, etc still makes no sen…

Https will prevent that keylogger from getting onto the users computer in the first place.

Re: Deprecating Non-Secure HTTP

#202

Post by bigiain »

nothrabannosir wrote: post #38
bigdubs wrote: post #24

Earlier quoted context omitted.

Why this project: https://letsencrypt.org/ is so important. From the site: Let’s Encrypt is a new Certificate Authority: It’s free, automated, and open. Arriving Mid-2015

That's just one project, and it doesn't even exist yet. The web is moving faster every day, apparently. I sure do hope that project will be all it's chalked up to be. For example, I need IP-only certs for a new project I'm working on (waiting for DNS to propagate to all clients is too unreliable and slow). If letsencrypt doesn't do that... well then I'd have to hope real hard for a competent CA out there who has an a…

StartSSL exists right now - and has been providing free certs for personal use for years now.

I'm curious about your requirement for IP only certs? Sure you don't "own" a domain name, but it's even less true that you "own" a specific IP address. (Well, at least for me, perhaps if your project is in the datacenter/isp/network-infrastructure space you might actually have some cintractual "ownership" of an IP address?)

Re: Deprecating Non-Secure HTTP

#203

Post by zmmmmm »

diafygi wrote: post #99

Here's two relevant Bugzilla bugs: Self-signed certificates are treated as errors: https://bugzilla.mozilla.org/show_bug.cgi?id=431386 Switch generic icon to negative feedback for non-https sites: https://bugzilla.mozilla.org/show_bug.cgi?id=1041087 Here's a proposed way of phasing this plan in over time: 1. Mid-2015: Start treating self signed certificates as unencrypted connections (i.e. stop showing a warning, but…

Why the hate for self-signed certificates?

I would personally rather see those promoted and methods developed to securely bootstrap them than make us all reliant on centralised CA infrastructure. The centralised CAs are all at the mercy of their governments and hence, in my opinion, ought to be considered almost as insecure as self-signed certs.

EDIT: I think I misunderstood your comment - reading again it sounds like you are also in favour of self-signed (hopefully so).

Re: Deprecating Non-Secure HTTP

#204

Post by pdkl95 »

joelrunyon wrote: post #23
nosefrog wrote: post #22

I should be happy about this -- who wouldn't want the entire web to be encrypted -- but SSL is so broken for normal people. SSL is expensive (wildcard certificates run $70 a year and up), confusing (how does one pick between the 200 different companies selling certificates?), and incredibly difficult to set up (what order should I cat the certificate pieces in again?). If SSL doesn't change, this move will cut the li…

Seriously, SSLs basically 2x the hosting cost for low end hosting packages. Not great for people running small websites.

That is today's prices, based past demand. As demand for SSL hosting goes up, gradually replacing plaintext hosting, the price will come down.

I actually expect the price of plaintext HTTP hosting to go up a bit; partly due to reduced demand, but also due to increased risk/liability. With SSL being the "industry best practice", I expect at least a few bean counters will view the risk of private information leaks or hypothetical legal liability for enabling DDOS (similar to the "attractive nuisance" doctrine).

There will be a turbulent transition period, of course. As someone currently living at the poverty line, I have argued against the CA system many times. A SSL cert (and anual renewal) may be an insignificant cost to some people, but it is a real barrier when tha cost represents days/weeks of food. Unfortunately, none of this removes the need for encryption or the risks of plaintext. This is why I'm very excited about Let’s Encrypt; It might solve the cost problem, and it might avoid the StartSSL "no second-source" problem because it is a protocol first.

Internet use is only going up, so these transition costs are only going to go up. We can pay it now, or pay even more in the future.

Re: Deprecating Non-Secure HTTP

#205

Post by joosters »

bigiain wrote: post #202
nothrabannosir wrote: post #38

Earlier quoted context omitted.

That's just one project, and it doesn't even exist yet. The web is moving faster every day, apparently. I sure do hope that project will be all it's chalked up to be. For example, I need IP-only certs for a new project I'm working on (waiting for DNS to propagate to all clients is too unreliable and slow). If letsencrypt doesn't do that... well then I'd have to hope real hard for a competent CA out there who has an a…

StartSSL exists right now - and has been providing free certs for personal use for years now. I'm curious about your requirement for IP only certs? Sure you don't "own" a domain name, but it's even less true that you "own" a specific IP address. (Well, at least for me, perhaps if your project is in the datacenter/isp/network-infrastructure space you might actually have some cintractual "ownership" of an IP address?)

StartSSL is far from simple to use.

Re: Deprecating Non-Secure HTTP

#207

Post by throwaway41597 »

tomjen3 wrote: post #197
bigdubs wrote: post #24

Earlier quoted context omitted.

Why this project: https://letsencrypt.org/ is so important. From the site: Let’s Encrypt is a new Certificate Authority: It’s free, automated, and open. Arriving Mid-2015

It is waperware. Plus it requires you to run special software on your servers (not possible in a shared hosting environment).

> it requires you to run special software on your servers

It doesn't, they ship a tool only for convenience. An open source tool running on your machine would be reverse-engineerable anyway. Plus, it is expected that shared hosting providers will run the tool for you.

Re: Deprecating Non-Secure HTTP

#208

Post by xorcist »

adventured wrote: post #37
joelrunyon wrote: post #23

Earlier quoted context omitted.

Seriously, SSLs basically 2x the hosting cost for low end hosting packages. Not great for people running small websites.

SSL should be a universally available free resource. I expect that it will be in the near future. That said, it is still very cheap for small sites too: $9 - $11 / year for perfectly good certs. Less than $1 per month is a small burden. https://www.namecheap.com/security/ssl-certificates/domain-v...

That's not the cost. You have to pay someone to re-sign your cert every (other) year. This is a largely manual process. It's also going to cost you, if you want any compensation at all when they forget. Which they will, no matter how well you prepare.

Re: Deprecating Non-Secure HTTP

#209

Post by xorcist »

nileshtrivedi wrote: post #167
nosefrog wrote: post #22

I should be happy about this -- who wouldn't want the entire web to be encrypted -- but SSL is so broken for normal people. SSL is expensive (wildcard certificates run $70 a year and up), confusing (how does one pick between the 200 different companies selling certificates?), and incredibly difficult to set up (what order should I cat the certificate pieces in again?). If SSL doesn't change, this move will cut the li…

Can someone explain why we can't give SSL certificates along with domain registration? We already trust the DNS, don't we?

The original idea with SSL was to give out certificates to organizations, not domain holders. The labour involved made this an expensive process and today domain validated certificates are the most common.

The idea was that users should want to validate they speak with the organization McDonald's, not with mcdonalds.com which may or may not belong to them. Turns out users don't, and that the distinction gets even less important over time. Domain names is an important identifier for an organization now. You can still however see the old process at work in EV certificates, which normally carries an extra cost.

If SSL had been designed for domain validation from the start, if would have looked like DNSSEC. Cryptographically verified domain assignments is a good idea, and infinitely more secure than the domain validation schemes we use today.

Here at HN there are a handful who can't resist going on about NSA every time DNSSEC is mentioned, so I expect a few of those now. Please do understand the whole picture and how the complete certificate stack works before taking those statements at face value.

Re: Deprecating Non-Secure HTTP

#210

Post by shurcooL »

nosefrog wrote: post #22

I should be happy about this -- who wouldn't want the entire web to be encrypted -- but SSL is so broken for normal people. SSL is expensive (wildcard certificates run $70 a year and up), confusing (how does one pick between the 200 different companies selling certificates?), and incredibly difficult to set up (what order should I cat the certificate pieces in again?). If SSL doesn't change, this move will cut the li…

This article from 2014 [0] suggested Google Domains [1] may offer free SSL certificates. As far as I can see, that's not the case at this time. Does anyone have any information on this? How likely is it that this feature will come in the near future?

[0] http://techcrunch.com/2014/06/24/with-google-domains-its-tim...

[1] https://domains.google.com/about/

Post reply on HN