Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Switch to HTTPS Now, For Free

konklone.com

Post reply on HN
Print view View original

221–230 of 264 posts

Re: Switch to HTTPS Now, For Free

#221

Post by konklone »

bigiain wrote: post #125
konklone wrote: post #111

Earlier quoted context omitted.

Google Analytics data is anonymized and aggregated - it's very different than request patterns and sessions tied to a specific IP.

The data Google give back to you in Analytics may be "anonymized and aggregated", but the data you're allowing them to collect from your users on your behalf is certainly individually-identifying and specific (and shareable with the NSA either wholesale via some PRISM-like means, or at the very least via court order or NSL)

I've been told Piwik (http://piwik.org) is very good. I'll give them a shot. If they're good enough, maybe I'll replace Google Analytics with them - then at least I own all the data myself.

Re: Switch to HTTPS Now, For Free

#222

Post by konklone »

alextingle wrote: post #209
Tichy wrote: post #194

Earlier quoted context omitted.

Are you sure they only use one domain? Perhaps for analytics, but there is also adsense, doubleclick and who knows what else.

I don't mind adsense, and if I did, there's always AdBlock. No, analytics was annoying me because of page load time. The number of times my browser stopped loading because "waiting for google-analytics.com" got me wound up enough one day to just block them for good.

Yeah, I use this myself a lot, especially when I'm in places with bad wifi.

I mentioned this in a separate comment, but I can use this as inspiration to try out Piwik (http://piwik.org), and see if it can replace Google Analytics.

I use Chartbeat for real-time-y stuff and alerts, which it's exceptional at. I think Piwik may have a harder time replacing that one, but I'll certainly try it.

Re: Switch to HTTPS Now, For Free

#223

Post by dgesang »

victorf wrote: post #151
dgesang wrote: post #143

Earlier quoted context omitted.

Someone should probably also point out: most of the CAs are more or less equally 'crappy'. We've been through many CAs now and none of them has a process anywhere near 'perfect'. Btw, Comodo customer support is rather nice. We recently bought a code signing certificate from them and they walked us through the whole process via chat, worked quite well and we were done in about 30 min.

Do you not feel that, due to the security failure in 2011, they are one of the worst? I typically disable their certificate on my machines. The CA system is totally flawed anyway, I don't know why I bother.

I didn't know about that incident. Thanks for pointing it out. Here are some references:

https://www.schneier.com/blog/archives/2011/03/comodo_group_...

https://kb.bluecoat.com/index?page=content&id=SA54&actp=RSS

Re: Switch to HTTPS Now, For Free

#224

Post by asdasf »

baudehlo wrote: post #218
asdasf wrote: post #212

Earlier quoted context omitted.

Which browser makes it clear to the user that some unknown organization has "verified" the business hosting the domain they are at? All a user sees is a little lock, no matter what cert you buy.

EV Certs show the company identity, which has been verified. Go to paypal for an example.

Where? Changing the color of the lock? That's the whole point, users have absolutely no idea that means anything, they can not differentiate between certs.

Re: Switch to HTTPS Now, For Free

#225

Post by victorf »

pantaril wrote: post #206
majelix wrote: post #197

Earlier quoted context omitted.

> The CA system is totally flawed anyway The flaw basically being that people aren't trustworthy, yes? Do you have any alternatives? There's ssh's model, where you just hope it's the right certificate the first time; or maybe mob-source it like WoT?

There are flaws with current PKI infrastructure but as you say, it's better than nothing. There are also several initiatives to improve this situation. Google has come with certificate transparency ( http://www.certificate-transparency.org/ ) which essentialy creates public log of all issued certificates so everyone can see and verify that certificates authorities don't issue bogus/fake certificates There is also an…

I like the idea of a blockchain for it, the only downside would be using all that space.

Re: Switch to HTTPS Now, For Free

#226

Post by alecsmart1 »

dpe82 wrote: post #25
jakobe wrote: post #15

I just recently enabled SSL on my business website. It was anything but simple. First of all, I had to get a dedicated server, because a bunch of other sites were running on the same server, and the hosting company doesn't offer additional IP addresses. Then I wanted to get an SSL certificate. I picked Comodo, because they seemed to offer the cheapest full business validation certificate, but then accidentally bought…

Someone should probably point out: most of your problems were related to doing full business validation from a crappy provider. Business validation is optional and doesn't enhance the transport-layer security benefits of using SSL.

Since you mentioned crappy provider, I would like to add that there is an illusion of choice when it comes to SSL certificates. When I was purchasing an SSL certificate, I researched many and after speaking to the same sales rep on multiple sites, I realized they are all the same company. To quote-

Symantec’s family of dominant SSL brands includes VeriSign, GeoTrust, Thawte, RapidSSL and TC Trust Center.

They own about 70% of the certificates, all priced differently to give you an illusion of choice. So if one provider is crappy, their support is the same; and thus they are all crappy.

Re: Switch to HTTPS Now, For Free

#227

Post by elchief »

wglb wrote: post #201
elchief wrote: post #167

Earlier quoted context omitted.

Don't use HTTP compression on private responses when using TLS. It's okay to HTTP compress publicly available images/scripts/stylesheets

Well, be careful that it is just the body that gets compressed. The vulnerability occurs when the cookie is part of the compression payload. Although that does depend on the attacker being able to control what gets sent.

Probably best to serve your public/static content on a cookie-less domain, so your session cookie is not sent on those requests.

Re: Switch to HTTPS Now, For Free

#228

Post by tedunangst »

tptacek wrote: post #211
tedunangst wrote: post #120

Earlier quoted context omitted.

I agree and disagree. Not all adversaries have active intercept capabilities. Some are just passive. Defending against them isn't entirely pointless. I really, really dislike the CA cabal. Self signed "encrypt only" certs combined with auto cert pinning in browsers would probably solve 99% of the problem.

What's a "just passive" adversary, other than a "potentially active adversary that chooses not to use the information they're collecting to leverage an active attack"? Nobody likes the CA problem, but you can't handwave the problem away. TACK (which provides auto-pinning) is hopefully going to be a solution to the lack of trustworthiness in CAs, but TACK's deployment model also presumes a CA infrastructure.

Well, more or less exactly what you said. An active attack is detectable, a passive one is not. There is no risk to me if I walk around with a wifi adapter in promiscuous mode just recording traffic. Actually doing a mitm exceeds my admittedly low risk tolerance.

Re: Switch to HTTPS Now, For Free

#229

Post by IgorPartola »

This is where domain registrars should give you a basic wildcard SSL cert for free when you register the domain. There is no reason why you should get that separately. The first registrar to realize that it is basically free to them to provide you the SSL cert and bundle the two things together wins.

I also wonder if advances in DNSSEC will help eliminate various SSL cert dealers: if you have a secure way to prove that example.com translates to a given IP, and DNSSEC could distribute the public cert for HTTPS in some standard manner, then CA's have no reason to exist anymore. See http://blog.huque.com/2012/10/dnssec-and-certificates.html for a decent discussion of this.

Edit: even better, if I could provide a secure way for you to communicate with my site over HTTPS without relying on a CA, I could also provide you my public GPG key securely. That way you know that me@example.com really has the certificate with ID DEADBEEF. Of course you don't know that I am Igor Partola is who claims to own igorpartola.com, but at least you can securely associate the email address with the GPG key, which is good enough if you, let's say, only know me as my online identity and only care to communicate with me about things related to that identity.

For example, if you found a project of mine on GitHub, and found a huge security flaw in it, you might want to securely email me an exploit and a patch without advertising the vulnerability to the world. It's good enough to have the email/GPG key association without needing to authenticate my real-life identity.

Re: Switch to HTTPS Now, For Free

#230

Post by valtron »

tptacek wrote: post #214
valtron wrote: post #107

Earlier quoted context omitted.

Still, having #1 is still better than neither. Instead of the NSA (sorry for beating a dead horse) simply siphoning your plaintext off the wire, isn't it more secure if you force them to have to actively fudge every single key exchange in order to read your traffic? (The "locks on doors" argument.)

The problem with this argument is that you don't need to be the NSA to compromise an unauthenticated encrypted channel; that's a task well within the capabilities of online criminals.

I'm didn't mean NSA specifically; that was just an example. I know it doesn't require massive hardware or anything like that because it doesn't involve breaking the encryption.

My original point is twofold:

First, having encrypted/unauthenticated communication is still better because it takes more effort to intercept, while doing so for unencrypted/unauthenticated is trivial (e.g. Google's WiFi sniffing debacle).

Second, encrypted/unauthenticated can be implemented to be almost completely transparent (for example, server and browser do a key exchange on every request; kind of how gzip compression is automatic), whereas encrypted/authenticated requires certificates (which you have to pay for, renew, copy on your server, etc.).

Right now X% of sites use HTTPS and (100 - X)% don't. It would be best if 100% of sites used HTTPS. But using _some_ form of encryption for the (100 - X)% is better than nothing, and more achievable than saying "encryption-only is useless, everyone should use authentication as well".

(I can't find any stats for HTTPS usage, hence the variables.)

Post reply on HN