Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS by default

security.googleblog.com

Post reply on HN
Print view View original

231–240 of 268 posts

Re: HTTPS by default

#231

Post by shadowgovt »

dns_snek wrote: post #168
shadowgovt wrote: post #37

Earlier quoted context omitted.

This puts the question into my brain, which I have never thought to pursue, of whether you could offer a self-signed cert that the user has to install for HTTPS. Their client will complain loudly until and unless they install it, but then for those who care you could offer the best of both worlds. Almost certainly more trouble than it's worth. G'ah, and me without any free time to pursue a weekend hobby project!

> for those who care you could offer the best of both worlds. You're not really offering that because the first connection could've be intercepted.

Too true. The old model is that you have to sneaker-net that first step. To get someone's public key, you'd literally meet them in person and they'd hand you a copy. We don't do that anymore.

I can imagine alternate approaches (service that stores personal keys on an HTTPS server signed via a public cert, keys in peer-to-peer filesharing with the checksum provided side-channel), but that gets increasingly more elaborate for diminishing return.

Re: HTTPS by default

#232

Post by bell-cot »

mpeg wrote: post #222
bell-cot wrote: post #219

Earlier quoted context omitted.

> When ... I assume the ... If it's (1) obviously recent content*, and (2) something that needs little security - a city council member's blog, or recipes - then how much do you care that it's HTTP-only? *Or just date-insensitive

That's precisely the point of HTTPS, your harmless recipe site can start spreading malware without your knowledge if you make it HTTP, as the content can be changed by anyone it passes through.

> your harmless recipe site can ...

As can every recipe site with httpS - but a vulnerable WordPress plugin, or too-easy admin password, or malvertising, or a zillion other things.

But conveniently, "all sites gotta be httpS" puts the biggest part of the blame/load on the littlest little guys - who want to make and post good, unmonetized content. But don't have an IT skill set, nor want to deal with yet more admin overhead & costs.

Re: HTTPS by default

#233

Post by zoeysmithe »

ottah wrote: post #91

Mmmm, great that and mandatory key rotation every 90 days, plus needing to get a cert from an approved CA, means just that more busy work to have an independent web presence. I don't like people externalizing their security policy preferences. Yes this might be more secure for a class of use-cases, but I as a user should be allowed to decide my threat model. It's not like these initiatives really solve the risks pose…

As someone who has run email servers, I can guarantee you none of this is theater. If you remove all the anti-spam backing, email becomes a useless service. At least the kind of 'accept mail from anyone' smtp thing we all decided to standardize on.

Re: HTTPS by default

#234

Post by zoeysmithe »

philippta wrote: post #164

While this is great for end users, this just shows again what kind of monopoly Google has over the web by owning Chrome. I work at a company that also happens to run a CDN and the sheer amount of layers Google forces everyone to put onto their stack, which was a very simple text based protocol, is mind boggling. First there was simple TCP+HTTP. Then HTTPS came around, adding a lot of CPU load onto servers. Then they…

>First there was simple TCP+HTTP. Then HTTPS came around, adding a lot of CPU load onto servers.

You can't do e-commerce without encryption. You live under capitalism. Its weird to me to see capitalists not wanting to accept payments for goods. As far as the complexity argument, goes, wait until you see what goes on in your CPU! Or the codebase of your average website. There is no real simplicity and simplicity just ties people's hands.

These weird worship of simplicity just don't make sense. By this argument we should have never left the mainframe green-screen terminal world. Or the PDP era. Or the abacus era for that matter. An arbitrary line drawn in the sense is a near purely emotional appeal and the libertarian housecat meme when applied to technology.

Instead, this is a train with no final destination and those who think overwise are just engaging in nostalgia.

Re: HTTPS by default

#235

Post by speleding »

tialaramex wrote: post #7

I have had HTTPS-by-default for years and I can say that we're past the point where there's noticeable year-to-year change for which sites aren't HTTPS. It's almost always old stuff that pre-dates Let's Encrypt (and presumably just nobody ever added HTTPS). The news site which stopped updating in 2007, the blog somebody last posted to in 2011, that sort of thing. I think it's important to emphasise that although Tim'…

I don't like this change. There are a lot of SaaS business that allow you to create a CNAME along the lines of "saas_app_name.yourbusiness.com". For example Fastmail and Zoho do that, our business offers that feature as well. When you arrive at our site we do a redirect to a proper https URL.

But a browser will not accept a redirect from a domain with an incorrect certificate (and rightly so), so this will start failing if https becomes the default, unless we generate certificates for all those customers, many thousands in our case. And then we need to get those certificates to the AWS load balancer where we terminate https (not even sure if it can handle that many). I think we may need to retire that feature.

Re: HTTPS by default

#236

Post by saurik »

zoeysmithe wrote: post #234
philippta wrote: post #164

While this is great for end users, this just shows again what kind of monopoly Google has over the web by owning Chrome. I work at a company that also happens to run a CDN and the sheer amount of layers Google forces everyone to put onto their stack, which was a very simple text based protocol, is mind boggling. First there was simple TCP+HTTP. Then HTTPS came around, adding a lot of CPU load onto servers. Then they…

>First there was simple TCP+HTTP. Then HTTPS came around, adding a lot of CPU load onto servers. You can't do e-commerce without encryption. You live under capitalism. Its weird to me to see capitalists not wanting to accept payments for goods. As far as the complexity argument, goes, wait until you see what goes on in your CPU! Or the codebase of your average website. There is no real simplicity and simplicity just…

> Its weird to me to see capitalists not wanting to accept payments for goods.

Even the most hardcore capitalists refuse to take our money for their services, insisting on giving away free websites--some which don't even have any authentication at all--that have frustrating business models on the backend :(. The reason we encrypt the vast majority (by volume, not weight) of our web content is for integrity (so random other people can't hijack and modify what we render), and somewhat (but not sufficiently, as TLS is broken) for privacy, not because of some attempt to partake in capitalism.

Re: HTTPS by default

#237

Post by Theodores »

blitzar wrote: post #199
Arainach wrote: post #83

Earlier quoted context omitted.

The threat model of HTTP isn't site owners, it's that anyone else can change the content and you can't tell that it didn't come from the original site. It's not a strawman, it's a real attack that we've seen for decades. The entire guidance of "don't connect to an open wireless AP"? That's because a malicious actor who controlled the AP could read and modify your HTTP traffic - inject ads, read your passwords, update…

I thought the https push really came in the wake of the snowden disclosures - might be rewriting history however

It was beforehand, if my memory serves me correctly, by which time GCHQ/NSA had managed to hack it. I can remember the diagrams from the Snowden docs. If https:// did lock out our friendly spies, do you think we would be allowed to have it beyond anything apart from secure checkouts?

Re: HTTPS by default

#238

Post by saurik »

yardstick wrote: post #158
danpalmer wrote: post #140

Earlier quoted context omitted.

HTTPS doesn't have mandatory key rotation every 90 days. LetsEncrypt does for reasons that they document, but you can go elsewhere if you'd prefer. > I as a user should be allowed to decide my threat model Asking you if you want to proceed is allowing you to decide your threat model. > We have so much compliance theater around email, and we still have exactly the same threats and issues as existed twenty years ago. .…

> HTTPS doesn't have mandatory key rotation every 90 days. LetsEncrypt does for reasons that they document, but you can go elsewhere if you'd prefer. A lot of this discussion is about how the browsers define their security requirements on top of HTTPS/TLS/etc. Such as what CAs they trust by default, and what’s the maximum lifetime of a certificate before they won’t trust it. I believe it is now 2 years? Going even lo…

They don't require key rotation, though, merely certificate busy work; if they wanted key rotation they could try to add some mechanism for it, but I've been using the same key for over a decade now.

Re: HTTPS by default

#239

Post by voxic11 »

giobox wrote: post #133
fuzzzerd wrote: post #38

Earlier quoted context omitted.

I remember even back in the early 2000s https for credit card forms was pretty common. Surprised a company like Pandora wasn't with it by thr 2010s.

There is likely zero chance the OP's recollection is remotely correct. Pandora went public in 2011 with 80 million users, the chances of a publicly listed company of this size taking payments over HTTP in 2012 are about as close to zero as can be. If nothing else, their payment processor would drop them as a customer.

It seems, based on the article in the sibling comment, that Pandora took a overly narrow view of the encryption requirements for working with credit card data. So they served the web pages over HTTP and only used HTTPS for the API calls that transferred the credit card information. This is obviously still insecure because a MITM attack could inject javascript onto the page to steal the data while it was being entered, but at least in the case where an attacker could just read the traffic they might not be able to capture the credit card information.

I can totally believe there were still companies in existence at this time who were still following such misguided interpretations.

Re: HTTPS by default

#240

Post by mpeg »

bell-cot wrote: post #232
mpeg wrote: post #222

Earlier quoted context omitted.

That's precisely the point of HTTPS, your harmless recipe site can start spreading malware without your knowledge if you make it HTTP, as the content can be changed by anyone it passes through.

> your harmless recipe site can ... As can every recipe site with httpS - but a vulnerable WordPress plugin, or too-easy admin password, or malvertising, or a zillion other things. But conveniently, "all sites gotta be httpS" puts the biggest part of the blame/load on the littlest little guys - who want to make and post good, unmonetized content. But don't have an IT skill set, nor want to deal with yet more admin ov…

It really doesn't matter if a personal blog decides to serve only http as a niche protest. But you really don't want to go back to the times when most sites were http; we had:

- Massive government spying programs, people forget that Chat Control used to be the standard, everything you ever browsed, posted or said online could be monitored

- Tracking that you could not disable, where your ISP would work with publishers appending http headers to every request that uniquely identified you.

- Not only little guys, as you say, were using http, it was government sites, news sites, a huge part of the internet was unencrypted and vulnerable to mitm. As you say, yes, it's not the only attack vector but it was one of the easiest to exploit, where any random wifi access point you're connected to could steal your credentials.

Post reply on HN