Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Still Why No HTTPS?

troyhunt.com

Post reply on HN
Print view View original

251–260 of 345 posts

Re: Still Why No HTTPS?

#251

Post by anony121212 »

pornel wrote: post #239
bo1024 wrote: post #235

Maybe I’m wrong, but I feel SSL has a downside of relying on more centralization. If a visitor to my totally-static webpage wants to bypass that layer and request the http version directly, I’m going to let them. (Obviously not excited about the idea of being mitm’d but it’s not a security risk, so leave that tradeoff up to the visitor).

https://doesmysiteneedhttps.com/ MITM can do anything to your site, so your totally-static site may not be static any more at the victim's end. It may be a site collecting private details, attacking the browser, or using the victim to attack other sites. Your static HTTP site is a network vulnerability and a blank slate for the attacker.

So then disable javascript for http sites

Re: Still Why No HTTPS?

#253

Post by earthboundkid »

cesarb wrote: post #164
dm33tri wrote: post #144

Why do browsers punish non-verified certs much harder than no-cert? If I want to quickly host my page and use encryption, then I have go through all that hustle to make it work. Perhaps allow use of self-signed certificates on same level as http instead of blocking my website.

Since there's no way to distinguish a non-verified (self-signed or not) certificate from an attack, browsers have to treat them identically to an attack (otherwise an attacker would simply pretend to be a non-verified certificate, to get the more lenient treatment). On the other hand, a no-cert (unencrypted) connection can be distinguished from an attack on an encrypted connection: the browser knows a priori (through…

Yes, also the browser can know if a site should be HTTPS through a https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/St... header, which can be preloaded in some browsers.

Re: Still Why No HTTPS?

#255

Post by mook »

zurn wrote: post #115
BrandoElFollito wrote: post #113

Because HTTPS is not as easy as HTTP. Sure there is Let's Encrypt and if you are facing Internet you are probably good to go. If you are on an internal network, then good luck. You need to build a PKI, and then put into your devices the right certificate so that it is trusted. If it was simpler, Apache would sing out its "It works!" in HTTPS and not HTTP.

Let's Encrypt works on internal networks too. Fun fact: TLS doesn't require certificates, and some browsers even used to support HTTPS in these TLS modes many moons ago. See eg https://security.stackexchange.com/questions/23024/can-diffi...

Let's Encrypt only works on public domains that happen to not route externally. I can never (or at least, should never) get LE certificates for *.pikachu.local, but that's a perfectly valid hostname for a local machine.

Re: Still Why No HTTPS?

#256

Post by umvi »

notatoad wrote: post #247
dm33tri wrote: post #144

Why do browsers punish non-verified certs much harder than no-cert? If I want to quickly host my page and use encryption, then I have go through all that hustle to make it work. Perhaps allow use of self-signed certificates on same level as http instead of blocking my website.

because warning fatigue is real and http usage is too high to put scary warnings on all those sites. Chrome's eventual goal is to mark all not-secure pages as not-secure: https://www.chromium.org/Home/chromium-security/marking-http...

> because warning fatigue is real

"HTTP is known to cause cancer in the state of California"

Re: Still Why No HTTPS?

#258

Post by LinuxBender »

It isn't just web sites. Many software repos still use http or native rsync. Some would argue that you validate the packages with GPG, but you would be amazed if you saw how many people install the GPG public key from the same mirror they download software from.

Re: Still Why No HTTPS?

#259

Post by surge »

LinuxBender wrote: post #258

It isn't just web sites. Many software repos still use http or native rsync. Some would argue that you validate the packages with GPG, but you would be amazed if you saw how many people install the GPG public key from the same mirror they download software from.

Gradle, granted they're fixing it.

https://blog.gradle.org/decommissioning-http

Re: Still Why No HTTPS?

#260

Post by ben_jones »

zamadatix wrote: post #207
UI_at_80x24 wrote: post #167

Earlier quoted context omitted.

>go through all that hustle.... I manage 100+ servers, hosting a significantly larger number of domains, on a variety of linux and FreeBSD operating systems. Under both Apache & Nginx. "..all of that hustle.." to initially setup is under 2 minutes with LetsEncrypt. The renewal (via a cron job) is completely out-of-sight/out-of-mind. The execution is shockingly simple. If you think it's "all that hassle" I guarantee y…

You're a professional plumber working on hundreds of households saying it's shockingly simple and should take no time at all for a first time home owner to fix their own plumbing. You've already got the knowledge, experience, and tools/parts in the van - of course you don't think it's a hassle!

Extended with: "and all his customers are based in a country with strong plumbing standards and regulatory guidelines" - rendering his advice less valid for every country which doesn't.

A practical example I ran into lately, we had a small system run on GKE and Google Cloud Loadbalancer and struggled to automate the certificate renewal process. Because the cluster/project was for an internal tool this automation was given a low priority and we still have to "manually" swap a certificate every few months (and if we forget to we get an angry slack DM).

TLDR; there are still many combinations of networked services that still do not ~easily~ support certificate automation, even ones you expect really should by now.

Post reply on HN