Still Why No HTTPS? • Hacker News Board

Re: Still Why No HTTPS?

#241

Post by tialaramex » Tue, Dec 17, 2019, 5:35 PM UTC

AnIdiotOnTheNet wrote: post #176

onion-soup wrote: post #11

Earlier quoted context omitted.

While I appreciate the efforts of certbot to make it as user-friendly as possible I still find this state of things unforgivable. I don't know where it went wrong so that today a developer must spend time learning and tweaking a low-level encryption tools. I'm just saying https will never be 100% unless it becomes a baked-in feature of any hosting.

What is the value in HTTPS being 100%? That seems silly to me. Many many things do not have any need for encryption.

Most things would benefit from encryption. Even if you don't need integrity protection, and you don't have any need of privacy, and you don't care about authenticating your peers you still want encryption because otherwise middleboxes ossify everything.

If the middlebox can't see inside your flow because it's encrypted it can't object to whatever new thing it's scared of this time whether that's HD video or a new HTML tag.

Re: Still Why No HTTPS?

#242

Post by mrob » Tue, Dec 17, 2019, 5:35 PM UTC

knome wrote: post #193

lucideer wrote: post #183

Earlier quoted context omitted.

I think the point here is that there's also no way to distinguish a http request from an attack. It's fair enough to an argue that a self-signed cert could be an attack, but so could any http request. > a no-cert (unencrypted) connection can be distinguished from an attack on an encrypted connection: the browser knows a priori (through the protocol in the URL) that the connection is supposed to be unencrypted. I don'…

Rightly punishing the connection for having the trappings of security when it actually lacks it doesn't mean we need to punish openly insecure traffic. End users have been told time and again that http is insecure, and so it's fine to leave it. End users should also be able to trust that https means secure without having to distinguish between secure and secure unless I'm being mitm'd and needing to understand what a…

Most end users have no idea what HTTPS is. They've just been (incorrectly) taught that the padlock means it's secure. Disable the padlock for self-signed HTTPS, and disable the CA-signed HTTPS-only features, and it becomes strictly better than HTTP.

Re: Still Why No HTTPS?

#243

Post by sturgill » Tue, Dec 17, 2019, 5:40 PM UTC

hitpointdrew wrote: post #223

sturgill wrote: post #111

Earlier quoted context omitted.

AWS certificates are free. Cloudflare will also put SSL in front of your origin for free. So if you’re using AWS you get it for free. Or you can slap CloudFront or Cloudflare in front of your origin. I think the barrier is low enough that I SSL all the things (including my small side projects).

> AWS certificates are free. "Free", but you can only use them on AWS stuff. AWS makes it nice and easy (and does a bunch behind the scenes for you). Part of that behind-the-scenes is that they have control of the private key on their side. You want to use the AWS generated cert locally, or on another provider, too bad.

You’re right, but it’s pretty simple to slap CloudFront (or Cloudflare) ahead of those origins if you need to in a pinch. I don’t work for Amazon (and have no dog in the fight) but I am a fan of AWS. And if you’re ever using AWS for anything, there’s no reason to _not_ use their free certs.

Someone else mentioned Azure having a similar offering (I’ve never played with Azure so I can’t speak to it). And if 2/3 of the providers offer it, I’d imagine GCP will at some point as well.

I love how easy it’s becoming to launch SSL. LetsEncrypt did a lot to make it mainstream. I’ve never used LE but I am grateful for their impact on our industry.

Re: Still Why No HTTPS?

#244

Post by rumanator » Tue, Dec 17, 2019, 5:45 PM UTC

fishtacos wrote: post #215

giancarlostoro wrote: post #208

Earlier quoted context omitted.

To be reasonably fair Lets Encrypt makes it easy. I even have a $5 a year shared hosting account that gives me Lets Encrypt SSL certs through cpanel. I can't imagine this feature is unique only to this one random shared hosting provider.

Your $5 instance with cPanel management isn't really quite the same as someone manually managing 100 servers hosting these services on disparate configurations and environments. In other words, what your tooling of choice automates in a specific situation doesn't necessarily apply to any one else's usage, and scalability-wise, would be even more detached.

> Your $5 instance with cPanel management isn't really quite the same as someone manually managing 100 servers hosting these services on disparate configurations and environments.

Actually, it is. Some reverse proxies such as Traefik handle TLS certs automatically. You practically need to explicitly not want to do it.

Re: Still Why No HTTPS?

#245

Post by andrewfromx » Tue, Dec 17, 2019, 5:45 PM UTC

nhumrich wrote: post #227

andrewfromx wrote: post #180

i still use https://neverssl.com daily. I hope it never goes away.

Intentional that your link is https?

ha, no i think HN did that automatically? I wrote http without s

Re: Still Why No HTTPS?

#246

Post by gsich » Tue, Dec 17, 2019, 5:51 PM UTC

dijit wrote: post #101

gsich wrote: post #99

Earlier quoted context omitted.

You just don't.

Seems impractical, but ok.

With LTE I rarely have the need to use wlan.

Re: Still Why No HTTPS?

#247

Post by notatoad » Tue, Dec 17, 2019, 5:52 PM UTC

dm33tri wrote: post #144

Why do browsers punish non-verified certs much harder than no-cert? If I want to quickly host my page and use encryption, then I have go through all that hustle to make it work. Perhaps allow use of self-signed certificates on same level as http instead of blocking my website.

because warning fatigue is real and http usage is too high to put scary warnings on all those sites.

Chrome's eventual goal is to mark all not-secure pages as not-secure: https://www.chromium.org/Home/chromium-security/marking-http...

Re: Still Why No HTTPS?

#248

Post by gambler » Tue, Dec 17, 2019, 5:55 PM UTC

UI_at_80x24 wrote: post #167

dm33tri wrote: post #144

Why do browsers punish non-verified certs much harder than no-cert? If I want to quickly host my page and use encryption, then I have go through all that hustle to make it work. Perhaps allow use of self-signed certificates on same level as http instead of blocking my website.

>go through all that hustle.... I manage 100+ servers, hosting a significantly larger number of domains, on a variety of linux and FreeBSD operating systems. Under both Apache & Nginx. "..all of that hustle.." to initially setup is under 2 minutes with LetsEncrypt. The renewal (via a cron job) is completely out-of-sight/out-of-mind. The execution is shockingly simple. If you think it's "all that hassle" I guarantee y…

>The execution is shockingly simple.

Only if you're blindly running shell commands the effects of which you don't understand.

Re: Still Why No HTTPS?

#249

Post by kbr2000 » Tue, Dec 17, 2019, 5:57 PM UTC

onion-soup wrote: post #11

chungy wrote: post #9

Earlier quoted context omitted.

Instructions are here: https://certbot.eff.org/ I don't know how it could possibly be any simpler.

While I appreciate the efforts of certbot to make it as user-friendly as possible I still find this state of things unforgivable. I don't know where it went wrong so that today a developer must spend time learning and tweaking a low-level encryption tools. I'm just saying https will never be 100% unless it becomes a baked-in feature of any hosting.

A management fad called dev-ops is what went wrong, before you could count on your sysadmin to take care of that :) Apart from that, not everything always makes sense to use in production without a good level of understanding --- and might otherwise lead to, for example, a false sense of security.

Re: Still Why No HTTPS?

#250

Post by AnIdiotOnTheNet » Tue, Dec 17, 2019, 6:08 PM UTC

tialaramex wrote: post #241

AnIdiotOnTheNet wrote: post #176

Earlier quoted context omitted.

What is the value in HTTPS being 100%? That seems silly to me. Many many things do not have any need for encryption.

Most things would benefit from encryption. Even if you don't need integrity protection, and you don't have any need of privacy, and you don't care about authenticating your peers you still want encryption because otherwise middleboxes ossify everything. If the middlebox can't see inside your flow because it's encrypted it can't object to whatever new thing it's scared of this time whether that's HD video or a new HTM…

Not a significant issue in practice as far as I can tell. I deliver text over the internet, and sometimes binaries over the internet, and it happens very fast because there is no useless cruft in the process to satisfy some security twonk's paranoid delusions.