Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Still Why No HTTPS?

troyhunt.com

Post reply on HN
Print view View original

231–240 of 345 posts

Re: Still Why No HTTPS?

#231

Post by chuckhoupt »

jcranmer wrote: post #221
chuckhoupt wrote: post #206

Earlier quoted context omitted.

w3.org redirect to www.w3.org, but not HTTPS. This makes sense for the standards org that defines HTTP, and needs to maintain backwards compatibility.

Except the standards org that defines HTTP is the IETF, not the W3C...

Opps! You're right, the W3C only helped author it.

I was also wrong to say that w3.org never redirects to HTTPS. If the browsers sends a Upgrade-Insecure-Requests HTTP-header, then it redirects. That allows it to support all browsers as securely as possible.

Sites like whynohttps.com and observatory.mozilla.org should really test for this pattern.

Re: Still Why No HTTPS?

#232

Post by tbyehl »

sturgill wrote: post #111
founderling wrote: post #70

Because there is only one free certificate provider (lets encrypt) and it does not allow wildcard certificates via server authentification. Having the DNS credentials laying around on the server is not a good idea. So creating wildcard certs via letsencrypt is a huge pain in the ass. If a webmaster has control over somedomain.com I think that is enough to assume he has control over *.somedomain.com. So I think letsen…

AWS certificates are free. Cloudflare will also put SSL in front of your origin for free. So if you’re using AWS you get it for free. Or you can slap CloudFront or Cloudflare in front of your origin. I think the barrier is low enough that I SSL all the things (including my small side projects).

> Cloudflare will also put SSL in front of your origin for free.

Used to be everyone complained about CF putting SSL in front of HTTP origins.

However, CF can also issue a CF-signed certificate with a stupid long expiration for your origins[1] and validate it. This is how I fully SSL many of the things while avoiding potential headaches with LE / ACME. Combine with Authenticated Origin Pulls[2] and firewalling to CF's IP ranges[3] for further security.

Of course, that still leaves CF doing a MITM on all my things.

[1] https://blog.cloudflare.com/cloudflare-ca-encryption-origin/

[2] https://blog.cloudflare.com/protecting-the-origin-with-tls-a...

[3] https://www.cloudflare.com/ips/

Re: Still Why No HTTPS?

#233

Post by JoshTriplett »

dm33tri wrote: post #144

Why do browsers punish non-verified certs much harder than no-cert? If I want to quickly host my page and use encryption, then I have go through all that hustle to make it work. Perhaps allow use of self-signed certificates on same level as http instead of blocking my website.

> Why do browsers punish non-verified certs much harder than no-cert?

Because it's taking time to build enough acceptance to flag http as insecure, whereas bad https connections that can't guarantee the expected security properties have been flagged as insecure from the beginning.

At this point, though, modern browsers show http sites as various flavors of "not secure" in the address bar, and limit what those sites can do. Browsers will increase the restrictions on insecure http over time, and hopefully get to the point where insecure http outside the local network gets treated much like bad https.

Re: Still Why No HTTPS?

#234

Post by mrob »

yencabulator wrote: post #224
lucideer wrote: post #183

Earlier quoted context omitted.

I think the point here is that there's also no way to distinguish a http request from an attack. It's fair enough to an argue that a self-signed cert could be an attack, but so could any http request. > a no-cert (unencrypted) connection can be distinguished from an attack on an encrypted connection: the browser knows a priori (through the protocol in the URL) that the connection is supposed to be unencrypted. I don'…

The http version can't access secure cookies; https with the wrong cert can use the secure cookies of the real https site.

So disable secure cookies by default for self-signed certs. The scary warnings can be shown when the user tries to enable them.

Re: Still Why No HTTPS?

#235

Post by bo1024 »

Maybe I’m wrong, but I feel SSL has a downside of relying on more centralization. If a visitor to my totally-static webpage wants to bypass that layer and request the http version directly, I’m going to let them. (Obviously not excited about the idea of being mitm’d but it’s not a security risk, so leave that tradeoff up to the visitor).

Re: Still Why No HTTPS?

#236

Post by certera »

elcomet wrote: post #12
chungy wrote: post #9

Earlier quoted context omitted.

Instructions are here: https://certbot.eff.org/ I don't know how it could possibly be any simpler.

It is simple for a one-server website. When you're on Alexa 1M, you certainly have a load balancer, multiple servers for redundancy, etc. It makes things not straightforward, and you certainly don't want to use the default certbot which overwrites your config.

Shameless plug for Certera for these more complex scenarios: https://docs.certera.io

I found that the certs behind a load balancer were enough of a problem that a solution was needed.

Re: Still Why No HTTPS?

#237

Post by thrower123 »

mattferderer wrote: post #197
thrower123 wrote: post #79

Earlier quoted context omitted.

When I looked at doing it, I'd have to bump up my hosting plan for my vanity blog to somewhere in the neighborhood of $100/month to apply an SSL cert for my custom domain, which is just stupid for a site that gets a couple thousand visits a month and maybe earns me $5 in referral fees.

I believe it's free now - https://docs.microsoft.com/en-us/azure/app-service/configure... Though hopefully they simplify it for cases such as yours. Putting Cloudflare in front is also another cheap option.

It looks like you have to go up to at least a B1 app service, which at $50/month doesn't make a lot of sense for me, unless I can figure how to get my MSDN credits associated with that Azure subscription instead of one of the other two accounts I don't use, but that's a whole other can of worms...

Re: Still Why No HTTPS?

#238

Post by allset_ »

zzzcpan wrote: post #214
zamadatix wrote: post #207

Earlier quoted context omitted.

You're a professional plumber working on hundreds of households saying it's shockingly simple and should take no time at all for a first time home owner to fix their own plumbing. You've already got the knowledge, experience, and tools/parts in the van - of course you don't think it's a hassle!

And he's not even right. There is no hassle only if you take plenty of risk and rely on a random crappy acme client to do it well, its dependencies to always work, disks, OSes, servers not failing, acme protocol not changing and not deprecating anything. Otherwise you need some infrastructure: logging, monitoring, some way to manage upgrades, backups, testing recovery, oh and those private keys are better not be leak…

Everything in your comment has to do with general server maintenance, and is not specific to automating certificate renewal with certbot or a similar tool which is what is being discussed. Adding HTTPS to your site and setting up automatic renewal is literally three steps on an Ubuntu system and you can copy and paste it from the certbot documentation [1].

[1] https://certbot.eff.org/lets-encrypt/ubuntubionic-nginx

Re: Still Why No HTTPS?

#239

Post by pornel »

bo1024 wrote: post #235

Maybe I’m wrong, but I feel SSL has a downside of relying on more centralization. If a visitor to my totally-static webpage wants to bypass that layer and request the http version directly, I’m going to let them. (Obviously not excited about the idea of being mitm’d but it’s not a security risk, so leave that tradeoff up to the visitor).

https://doesmysiteneedhttps.com/

MITM can do anything to your site, so your totally-static site may not be static any more at the victim's end. It may be a site collecting private details, attacking the browser, or using the victim to attack other sites.

Your static HTTP site is a network vulnerability and a blank slate for the attacker.

Re: Still Why No HTTPS?

#240

Post by zzzcpan »

allset_ wrote: post #238
zzzcpan wrote: post #214

Earlier quoted context omitted.

And he's not even right. There is no hassle only if you take plenty of risk and rely on a random crappy acme client to do it well, its dependencies to always work, disks, OSes, servers not failing, acme protocol not changing and not deprecating anything. Otherwise you need some infrastructure: logging, monitoring, some way to manage upgrades, backups, testing recovery, oh and those private keys are better not be leak…

Everything in your comment has to do with general server maintenance, and is not specific to automating certificate renewal with certbot or a similar tool which is what is being discussed. Adding HTTPS to your site and setting up automatic renewal is literally three steps on an Ubuntu system and you can copy and paste it from the certbot documentation [1]. [1] https://certbot.eff.org/lets-encrypt/ubuntubionic-nginx

Dealing with certificates is more critical than "general server maintenance", things people often neglect doing suddenly become required. It might take from a few months to even a couple of years to get from neglected infrastructure to infrastructure ready for reliable automated issuance of certificates.

I actually evaluated a bunch of acme clients, wasn't satisfied with the code of any of them and wrote my own. But even from those I looked at certbot was always the worst choice, it's ridiculous letsencrypt is promoting it, better choices were POSIX shell clients or statically linked clients, like those written in Go and other compiled languages.

Post reply on HN