Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS by default

security.googleblog.com

Post reply on HN
Print view View original

251–260 of 268 posts

Re: HTTPS by default

#251

Post by ottah »

danpalmer wrote: post #140
ottah wrote: post #91

Mmmm, great that and mandatory key rotation every 90 days, plus needing to get a cert from an approved CA, means just that more busy work to have an independent web presence. I don't like people externalizing their security policy preferences. Yes this might be more secure for a class of use-cases, but I as a user should be allowed to decide my threat model. It's not like these initiatives really solve the risks pose…

HTTPS doesn't have mandatory key rotation every 90 days. LetsEncrypt does for reasons that they document, but you can go elsewhere if you'd prefer. > I as a user should be allowed to decide my threat model Asking you if you want to proceed is allowing you to decide your threat model. > We have so much compliance theater around email, and we still have exactly the same threats and issues as existed twenty years ago. .…

Well HTTPS the protocol might not, but the implementation is essentially going that way https://www.digicert.com/blog/tls-certificate-lifetimes-will...

Re: HTTPS by default

#252

Post by ottah »

hylaride wrote: post #229
ottah wrote: post #91

Mmmm, great that and mandatory key rotation every 90 days, plus needing to get a cert from an approved CA, means just that more busy work to have an independent web presence. I don't like people externalizing their security policy preferences. Yes this might be more secure for a class of use-cases, but I as a user should be allowed to decide my threat model. It's not like these initiatives really solve the risks pose…

This is all automatable and is well documented for almost every setup. If you're on a cloud provider/CDN it's even easier as they'll handle all this for you at pretty much no cost. You can also still use your own threat model. You can use self-signed certs, import your own CA, etc. The issue is that browsers need to service the mass market, including the figurative grandma who won't otherwise understand fake bank cer…

I guarantee you that your grandmother will still get phished with a valid domain certificate.

Re: HTTPS by default

#253

Post by ottah »

techbrovanguard wrote: post #120
ottah wrote: post #91

Mmmm, great that and mandatory key rotation every 90 days, plus needing to get a cert from an approved CA, means just that more busy work to have an independent web presence. I don't like people externalizing their security policy preferences. Yes this might be more secure for a class of use-cases, but I as a user should be allowed to decide my threat model. It's not like these initiatives really solve the risks pose…

You understand that key rotation can and should be automated, right?

It adds complexity, more points of failure, and ensures that more legacy services will go offline needlessly. While almost certainly not actually improving the actual security issues the average user experience. Lack of a valid tls certificate is usually not the reason people are victims of crime online.

Re: HTTPS by default

#254

Post by [deleted] »

1vuio0pswjnm7 wrote: post #151
vhcr wrote: post #21

Earlier quoted context omitted.

Depend on one less third party, you still depend on the DNS Root servers, your ISP / hosting, domain registry, etc.

Third party root servers are generally used for looking up TLD nameservers, not for looking up domainnames registered to individuals publishing personal blogs^1 Fortunately, one can publish on the www without using ICANN DNS For example http://199.233.217.201 or https://199.233.217.201 1. I have run own root server for over 15 years An individual cannot even mention choosing to publish a personal blog over HTTP witho…

[deleted]

Re: HTTPS by default

#255

Post by eadmund »

sam_lowry_ wrote: post #12
tialaramex wrote: post #7

I have had HTTPS-by-default for years and I can say that we're past the point where there's noticeable year-to-year change for which sites aren't HTTPS. It's almost always old stuff that pre-dates Let's Encrypt (and presumably just nobody ever added HTTPS). The news site which stopped updating in 2007, the blog somebody last posted to in 2011, that sort of thing. I think it's important to emphasise that although Tim'…

I run my blog in unencrypted HTTP/1.1 just to make a point that we do not have to depend on third parties to publish content online. And I noticed that Whatsapp is even worse than Chrome, it opens HTTPS even if I share HTTP links.

> I noticed that Whatsapp is even worse than Chrome, it opens HTT PS even if I share HTTP links.

Firefox does this when I type in a URL and the server is down. I absolutely hate this behaviour, because I run a bunch of services inside my network.

If I tell my browser ‘fetch http://site.example,’ I mean for it to connect to site.example on HTTP on port 80 nothing more. If there is a web server run ning which wants to redirect me to https://site.example, awesome, but my browser should never assume I mean anything I did not say.)

Re: HTTPS by default

#256

Post by dang »

eadmund wrote: post #255
sam_lowry_ wrote: post #12

Earlier quoted context omitted.

I run my blog in unencrypted HTTP/1.1 just to make a point that we do not have to depend on third parties to publish content online. And I noticed that Whatsapp is even worse than Chrome, it opens HTTPS even if I share HTTP links.

> I noticed that Whatsapp is even worse than Chrome, it opens HTT PS even if I share HTTP links. Firefox does this when I type in a URL and the server is down. I absolutely hate this behaviour, because I run a bunch of services inside my network. If I tell my browser ‘fetch http://site.example ,’ I mean for it to connect to site.example on HTTP on port 80 nothing more. If there is a web server run ning which wants to…

Sorry for the offtopicness but could you please email hn@ycombinator.com so I can explain why your comment only appeared here 14 hours after you tried 9 times to post it? :)

Re: HTTPS by default

#257

Post by protocolture »

EGreg wrote: post #143
protocolture wrote: post #125

Prediction: Wifi captive portal vendors will not react to this until after 90% of their customerbase has their funding dry up. It is incredibly common for public wifi captive portals to be built on a stack of hacks, some of which require the inspection of HTTP and DNS requests to function. *Yes better tools exist, but they dont arent commonly used, and require Portal, WAP and Client support. Most vendors just tell pe…

What are you talking about? You can easily build the captive portals by setting up a custom DNS server, and HTTPS has nothing to do with it! In fact, local networks have been doing this very thing for years now. Apple even supports Detecting this interception so the operating system can show a captive portal to the user. The OS maker gives network admins an official a way to enforce captive portals, and it’s not goin…

> Apple even supports Detecting this interception so the operating system

Whats it intercepting? Apples detection sends a HTTP/HTTPS request to captive.apple.com. If it fails, it assumes a captive portal. Theres also a DHCP option apple supports.

But even after detection, theres redirection.

Have a look at WAP Vendor options.

Heres Powerlynx explicitly requests disabling HTTPS before auth on Cambium in their user setup guide.

https://docs.powerlynx.app/networking/cambium.html

"Redirect HTTP-only - On"

This guarantees that, upon redirection, you are presented with a HTTP login page for the captive portal. And then any subsequent redirections, also have to be HTTP.

Heres Start Hotspot

https://go.starthotspot.com/help/cambium/

"Redirect: Tick HTTP-only"

Cambium supports more modern methods, but captive portal vendors are not going to shift before letting their customers fall on their face.

(Also, cambiums guest access whitelist is based on DNS and breaks with DNS over HTTPS/TLS)

Re: HTTPS by default

#258

Post by deepsun »

sam_lowry_ wrote: post #12
tialaramex wrote: post #7

I have had HTTPS-by-default for years and I can say that we're past the point where there's noticeable year-to-year change for which sites aren't HTTPS. It's almost always old stuff that pre-dates Let's Encrypt (and presumably just nobody ever added HTTPS). The news site which stopped updating in 2007, the blog somebody last posted to in 2011, that sort of thing. I think it's important to emphasise that although Tim'…

I run my blog in unencrypted HTTP/1.1 just to make a point that we do not have to depend on third parties to publish content online. And I noticed that Whatsapp is even worse than Chrome, it opens HTTPS even if I share HTTP links.

Yea, but then every time I open your blog, all the middle-men receive some metadata about my device/browser/language etc, that helps to fingerprint my activity online.

Re: HTTPS by default

#259

Post by EGreg »

protocolture wrote: post #257
EGreg wrote: post #143

Earlier quoted context omitted.

What are you talking about? You can easily build the captive portals by setting up a custom DNS server, and HTTPS has nothing to do with it! In fact, local networks have been doing this very thing for years now. Apple even supports Detecting this interception so the operating system can show a captive portal to the user. The OS maker gives network admins an official a way to enforce captive portals, and it’s not goin…

> Apple even supports Detecting this interception so the operating system Whats it intercepting? Apples detection sends a HTTP/HTTPS request to captive.apple.com. If it fails, it assumes a captive portal. Theres also a DHCP option apple supports. But even after detection, theres redirection. Have a look at WAP Vendor options. Heres Powerlynx explicitly requests disabling HTTPS before auth on Cambium in their user set…

But why do we need to avoid https at all? You can easily have CA-signed certificates and have DNS server resolve the local ourfreewifi.com domain. It’s your domain, you can even set up DNSSEC and it will be fine.

Re: HTTPS by default

#260

Post by ozim »

graynk wrote: post #169
sam_lowry_ wrote: post #63

Earlier quoted context omitted.

My ISP does not and if yours does, vote with your money or lobby your government to make this illegal. And while at it, lobby to make corporate MiTM tools illegal as well. Because if you are bothered about my little blog, you should be bothered that your employer can inspect all your HTTPS traffic.

Or you could do a much simpler thing and support HTTPS and not expect users to change ISPs (which is not always possible, e.g. in rural areas) or change laws (which is even less realistic) to browse your (or any other) blog. Injecting ads has nothing to do with corporate MITM, it's unquestionably bad, but unrelated here. More to the point: serving your blog with HTTPS via Let's Encrypt does not in any way forbid you…

To add to that rouge ISP employees don’t care if it is illegal.
Post reply on HN