Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Switch to HTTPS Now, For Free

konklone.com

Post reply on HN
Print view View original

231–240 of 264 posts

Re: Switch to HTTPS Now, For Free

#231

Post by valtron »

mikeash wrote: post #95
valtron wrote: post #93

As I understand it, (correct me if I'm wrong), https has two parts: 1. Encryption: protects from eavesdropping (e.g. your internet provider can't see what you're communicating) 2. Authentication: protects from MITM (e.g. someone changing the data en-route) For full security you need both; but #2 is much more complicated than #1 because it needs a trusted third party, certificates, etc. It's effectively a barrier to h…

I believe the problem is that it's impossible to distinguish between "the remote server doesn't care about authentication" and "the remote server cares about authentication, but your traffic to it is being intercepted and modified by an eavesdropper who is retransmitting the data without the authentication flag". You can opt for only #1, but virtually every browser will put up gigantic warnings about it because it's…

Unencrypted communication is also indistinguishable from a MITM attack.

Re: Switch to HTTPS Now, For Free

#232

Post by chc »

tlrobinson wrote: post #219
chc wrote: post #36

Just going to throw out that if you use a Cloudflare business plan, you can just tick a couple of boxes and get SSL for free.

While I like Cloudflare, it's worth noting you give up true "end to end" encryption SSL normally provides. It's entirely possible for Cloudflare to allow others to eavesdrop on your traffic, and in fact I think the connections between Cloudflare and your servers are normally unencrypted. Basically, using Cloudflare SSL is good for protecting your customers from eavesdroppers on WiFi, not so good for protecting agains…

Whether the connection between you and Cloudflare is encrypted is up to you. It's right in the same box as the option to turn on encryption in the first place.

Re: Switch to HTTPS Now, For Free

#233

Post by Spooky23 »

jakobe wrote: post #69
JoshTriplett wrote: post #51

Earlier quoted context omitted.

If you're willing to write off users of Internet Explorer on Windows XP, you don't need a dedicated IP for SSL; you can simply use Server Name Indication (SNI).

But then I'd need to support SSL for all domains hosted on the server, and this would mean getting 5 certificates instead of one.

Nope, just find a CA that will give you a certificate with SAN extensions at a cost that you can afford. Usually you can get up to 5 SANs at a reasonable cost, and up to 100-150 SANs for more dollars.

Re: Switch to HTTPS Now, For Free

#234

Post by ceejayoz »

uxp wrote: post #130
powertower wrote: post #117

Earlier quoted context omitted.

Except not even 99.9995% of your customers will know or care about the level of your SSL Cert. It really does not add anything to the equation. Just extra costs and work for you. It's been studied and pointed out that a green-bar does nothing to conversions and sales. I suggest skipping it always, but often times a higher business type will override the suggestion of whomever has to implement it and maintain it - sim…

It's been studied and pointed out that a green-bar does nothing to conversions and sales. I'm not debating this point, but if you have some citations for this assertion, I'd love to read them. I've always heard and read otherwise. I just completed a multiple-month-long process of converting a dynamic-domain application to support SSL-friendly URIs and implementing SSL on it's web servers based entirely on the concept…

Considering Amazon.com doesn't bother with an EV cert, I'd guess they don't affect conversions in any sort of positive manner.

Re: Switch to HTTPS Now, For Free

#235

Post by astrodust »

agwa wrote: post #63
JoshTriplett wrote: post #51

Earlier quoted context omitted.

If you're willing to write off users of Internet Explorer on Windows XP, you don't need a dedicated IP for SSL; you can simply use Server Name Indication (SNI).

Android 2.x also doesn't support SNI.

Android 2.x is rapidly becoming the new "Windows XP".

Re: Switch to HTTPS Now, For Free

#236

Post by mikeash »

valtron wrote: post #231
mikeash wrote: post #95

Earlier quoted context omitted.

I believe the problem is that it's impossible to distinguish between "the remote server doesn't care about authentication" and "the remote server cares about authentication, but your traffic to it is being intercepted and modified by an eavesdropper who is retransmitting the data without the authentication flag". You can opt for only #1, but virtually every browser will put up gigantic warnings about it because it's…

Unencrypted communication is also indistinguishable from a MITM attack.

Right, but it's distinguishable from encrypted communication.

We have client-side signals for those things. http means unencrypted, https means encrypted. To do encrypted-but-not-authenticated, I guess you'd need a third URL scheme for it, to know when you're supposed to get that, since you can't shoehorn it into https safely.

Re: Switch to HTTPS Now, For Free

#237

Post by astrodust »

chris_mahan wrote: post #61

When it's harder to get SSL working than to install debian stable on a machine, I'd say SSL is too hard.

This is mostly the fault of the SSL certificate providers, which vary in complexity between the obnoxious GoDaddy and even more obtuse and impossible to deal with.

Compounding this, the configuration file formats for each web server platform vary wildly, selecting the correct format and installing it properly can be tricky.

Making matters worse, it's very easy to set up something that looks like it's working, but is actually broken on some subset of the browsers out there.

These problems can be solved with better standards, better documentation, testing tools, and most of all, providers that actually care about the user experience they're selling.

Re: Switch to HTTPS Now, For Free

#238

Post by ceejayoz »

grinnick wrote: post #2

I used this guide to help switch a site to HTTPS just last week. Very useful and super simple. On issue I did run into (not relevant to the article but anyway) was that Heroku charges $20/month to use SSL on a custom domain.

I believe that's because Heroku's on AWS and using ELB, so they have to have an ELB just for you ($15/month).

Re: Switch to HTTPS Now, For Free

#240

Post by ryan-c »

alecsmart1 wrote: post #226
dpe82 wrote: post #25

Earlier quoted context omitted.

Someone should probably point out: most of your problems were related to doing full business validation from a crappy provider. Business validation is optional and doesn't enhance the transport-layer security benefits of using SSL.

Since you mentioned crappy provider, I would like to add that there is an illusion of choice when it comes to SSL certificates. When I was purchasing an SSL certificate, I researched many and after speaking to the same sales rep on multiple sites, I realized they are all the same company. To quote- Symantec’s family of dominant SSL brands includes VeriSign, GeoTrust, Thawte, RapidSSL and TC Trust Center. They own abo…

I use DigiCert at work, and have been very happy with their support, however they are not cheap.
Post reply on HN