Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encrypted web traffic now exceeds 90%

netmarketshare.com

Post reply on HN
Print view View original

211–220 of 311 posts

Re: Encrypted web traffic now exceeds 90%

#211

Post by tantalor »

Andrew_nenakhov wrote: post #168
kome wrote: post #154

Earlier quoted context omitted.

they are not end-to-end encrypted but they are encrypted. Also, I read that WhatsApp is going to switch to the same mode, for user convenience: https://bgr.com/2019/07/29/whatsapp-update-to-bring-multi-pl...

Oh, come on! If Telegram can decrypt chats for a user, they can decrypt it if they really want. Any other kind of encryption is irrelevant - from third party attackers, tls works good enough.

Yeh "endpoint security" is hard. You need some trusted specialized hardware or network.

https://en.wikipedia.org/wiki/End-to-end_encryption#Endpoint...

Re: Encrypted web traffic now exceeds 90%

#212

Post by mxcrossb »

flatiron wrote: post #191
rocqua wrote: post #183

Earlier quoted context omitted.

It is a very fair point that Snowden's revelations definitely had an impact. However, the impact you note was mostly technical. The public backlash to these revelations is what seems lacking. It had very small political effects, and seemingly very little effect on the NSA. They did not change their stance much, and their weren't really consequences for what the NSA was doing.

What’s more important though? The public can’t particularly change things at that level. They don’t live at that level. It’s our job to help them. Just as they help me on non computer related stuff all the time. A barber shouldn’t be in charge of web encryption. It’s on us.

Also, I think the public has no problem with the government spying on other people. They just don’t want it spying on them. So in that regard, it opposing the policy, but instead mitigating the risk to your own communications is an expected result.

Re: Encrypted web traffic now exceeds 90%

#213

Post by Bnshsysjab »

judge2020 wrote: post #189
zaarn wrote: post #126

Earlier quoted context omitted.

And even if they get a key, they will show up in the CT Logs eventually and the attack becomes public.

The effectiveness of CT logs isn't a thing unless the website uses CT monitoring or is a huge company. A [delegated or non-delegated] DNS takeover, or IP address release (eg. cloud providers re-assigning an IP to another customer) could allow you to generate a certificate for some-forgotten-subdomain.medium-sized.company.com using the ACME http challenge. Of course this is mitigated by properly managing your DNS, and…

Cert pinning mitigates this too right?

Re: Encrypted web traffic now exceeds 90%

#214

Post by Bnshsysjab »

judge2020 wrote: post #190
profmonocle wrote: post #123

Earlier quoted context omitted.

Certificate transparency would make it blatantly obvious if Chinese CAs were issuing bogus certificates. (And if they issued certs without submitting them to CT logs they wouldn't be accepted by Chrome or Safari, so it wouldn't be very useful.) Sure, they could do it, but it wouldn't be long until there were no Chinese CAs trusted by any browser.

An attack like this could still be done for CLI clients/library clients such as curl (ie. server-to-server connections), none of which I'm aware of incorporate CT log verification.

But the server can’t do header checks for CLI tools prior to certificate negotiations, so it would be difficult to get away with. Not impossible, but it’d limit your Targets to IPs who are exclusively non CR clients. Any slip up and you’d be busted.

Re: Encrypted web traffic now exceeds 90%

#215

Post by intolerabletech »

chrisweekly wrote: post #2

Awesome! Any idea how much of that is attributable to LetsEncrypt and HTTPSEverywhere?

It is amazing how HTTPSEverywhere has revealed how incompetent people are regarding TLS/SSL.

I can't count the number of times I've seen the extension page during sign-ups or logins. Oracle Cloud just triggered it the other day during signup and initial login. Most times when I email, asking why an email marketing link, or an embedded token-login email link sends me through an HTTP URL, the person on the other ends tells me they don't know and that's unexpected, or a result of out-sourcing their marketing/email/whatever.

In one case, their marketing mail provider supposedly just blanket intercepted all links and unknown-to-their-customers passed them through an HTTP redirect. Stunningly unprofessional.

Re: Encrypted web traffic now exceeds 90%

#216

Post by Macha »

svara wrote: post #73

We often hear the complaint here that nobody cares / cared about Snowden's revelations. But to me it seems he did provide a lot of the impetus for having HTTPS virtually everywhere and a lot of the instant messenging apps being end-to-end encrypted. Most of WhatsApp's users are as non-technical as it gets, and yet they use the kind of encryption that only computer enthusiasts were interested in just a couple years ag…

I feel Firesheep deserves at least some of the credit too: https://en.wikipedia.org/wiki/Firesheep

Re: Encrypted web traffic now exceeds 90%

#218

Post by lukeschlather »

freeflight wrote: post #143
lukeschlather wrote: post #138

Earlier quoted context omitted.

Google and AWS aren't eavesdropping directly. However a lot of companies are running unencrypted connections between their load balancers and their backend services. And we know from the Snowden documents the US Government does passive data collection there.

The USG does not need to look for weak points to do passive data collection. Due to the third-party doctrine [0], they can simply demand access, don't even need a legal warrant. Because there's no reasonable expectation of privacy for data you willingly gave to third parties. [0] https://en.wikipedia.org/wiki/Third-party_doctrine

It's easier to do it quietly though. If there's unencrypted network traffic, they just need to demand access from someone with physical access to the switches, plant a listening device, and everyone with logical access will be blissfully unaware.

If they want to MITM encrypted traffic they need to demand access from somebody with access to the certificates, who is going to be higher paid and more likely to speak to at least a lawyer before granting access.

Re: Encrypted web traffic now exceeds 90%

#219

Post by taftster »

wolco wrote: post #115
taftster wrote: post #48

Earlier quoted context omitted.

Right. Encrypted web traffic at 90% is different than encrypted web sites at 90%.

When netflix is half, torrent traffic included add in google/facebook/faangs and you arrive at 90% easily.

Don't forget porn.

Re: Encrypted web traffic now exceeds 90%

#220

Post by taftster »

chapium wrote: post #196
JohnFen wrote: post #171

Earlier quoted context omitted.

I don't consider a cert trustworthy just because it's signed by a CA, unless that CA is mine or one run by someone I personally know and trust. I came to this position before Snowden, though.

In the CA model is anything 100% yours? A signed cert has to depend on someone you dont know.

Unless it's self-signed. Presumably you do know yourself well enough?
Post reply on HN