Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Switch to HTTPS Now, For Free

konklone.com

Post reply on HN
Print view View original

251–260 of 264 posts

Re: Switch to HTTPS Now, For Free

#251

Post by ivanr »

espeed wrote: post #250
ivanr wrote: post #182

Earlier quoted context omitted.

Deploying SSL partially is very dangerous, because then you have to be _very_ careful that the session ID is not compromised. I'd go as far as to say that it's virtually impossible to do that securely (for the average web site, built by more than one person who are not security experts, maintained under pressure over a period of years, and so on). Someone else here mentioned SSL stripping, which is another problem, w…

Using encrypted tokens help mitigate stolen session IDs ( https://owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF... ). And while HSTS helps protect against sslstrip, you're still vulnerable to MITM attacks due to issues with the CA system. See moxie's 2011 talk "SSL and the Future of Authenticity" ( http://www.youtube.com/watch?v=Z7Wl2FW2TcA )

Encrypted tokens might help against CSRF, but if I have your session ID, it's game over. The best you can do is restrict the user agent used with the session, but that's an obstacle that can be overcome. You might try to restrict the IP address used with the session, too, but those change often even without attack that it's not practical, either.

The robustness of the public CA system is a legitimate problem, but it's not a concern for most of us. People like to complain that the public CA security model is not perfect, but we have to remember that the CA ecosystem was not designed for perfection; it was designed to enable ecommerce. We now have different goals (well, some of us) and have to change our approach accordingly.

MITM attacks using fraudulent certificates are very costly and make sense only against very high-value properties. If you're legitimately worried about them, you should consider using public key pinning, which effectively deals with the problem. (But, alas, only works in Chrome today.)

Re: Switch to HTTPS Now, For Free

#252

Post by megaframe »

Been wanting this for a long time but didn't know of a free vendor and didn't seem worth paying for (just for my personal use)... now I got it working on everything but OSX, it just does not seem to want to accept the cert.

Re: Switch to HTTPS Now, For Free

#253

Post by vmialik »

ceejayoz wrote: post #234
uxp wrote: post #130

Earlier quoted context omitted.

It's been studied and pointed out that a green-bar does nothing to conversions and sales. I'm not debating this point, but if you have some citations for this assertion, I'd love to read them. I've always heard and read otherwise. I just completed a multiple-month-long process of converting a dynamic-domain application to support SSL-friendly URIs and implementing SSL on it's web servers based entirely on the concept…

Considering Amazon.com doesn't bother with an EV cert, I'd guess they don't affect conversions in any sort of positive manner.

Once you click your Account, or try to login it will send you on via verified https:// regular pages and the cart does not have SSL. Possibly for speed issues

Re: Switch to HTTPS Now, For Free

#254

Post by zobzu »

nwh wrote: post #123
zobzu wrote: post #122

Earlier quoted context omitted.

Unless you visited the site before. (like ssh). Or if the trust was provided through another channel (DNS).

If somebody can tamper with your HTTP connections on the fly, they can surely rewrite the DNS too.

maybe, maybe not they use separate paths in general so its quite a bit hard as you need to be closer to the client, or compromise more hosts. not saying it's the bulletproof solution tho. it's definitely not. its just that some services (like ssh) actually provide that feature.

Re: Switch to HTTPS Now, For Free

#255

Post by Zoepfli »

makomk wrote: post #202
Zoepfli wrote: post #150

Earlier quoted context omitted.

Funny, it is for me: any wikipedia page redirects to its https counterpart. E.g. http://en.wikipedia.org/wiki/Hacker_News redirects to https://en.wikipedia.org/wiki/Hacker_News .

Do you have a user account at Wikipedia by any chance? They've been redirecting logged-in users to the SSL version for a while, and under some circumstances it also seems to redirect users who have been logged in but aren't right now.

I do indeed have a WP account. It redirects as well when I'm logged out.

Re: Switch to HTTPS Now, For Free

#256

Post by Zoepfli »

StavrosK wrote: post #178
Zoepfli wrote: post #150

Earlier quoted context omitted.

Funny, it is for me: any wikipedia page redirects to its https counterpart. E.g. http://en.wikipedia.org/wiki/Hacker_News redirects to https://en.wikipedia.org/wiki/Hacker_News .

Are you using the HTTPS Everywhere extension, perhaps?

No I'm not. I'd love to, but there is none for Safari as far as I'm aware of.

Re: Switch to HTTPS Now, For Free

#257

Post by ceejayoz »

vmialik wrote: post #253
ceejayoz wrote: post #234

Earlier quoted context omitted.

Considering Amazon.com doesn't bother with an EV cert, I'd guess they don't affect conversions in any sort of positive manner.

Once you click your Account, or try to login it will send you on via verified https:// regular pages and the cart does not have SSL. Possibly for speed issues

Yes, it's HTTPS, but it's not EV HTTPS. There's no green bar, just the lock icon that anyone with a $7/year SSL gets.

Re: Switch to HTTPS Now, For Free

#258

Post by xenophonf »

cpncrunch wrote: post #207
elchief wrote: post #168

Earlier quoted context omitted.

If you read their terms, and I have, you definitely can't use the free certs for shopping or banking sites. It's kind of vague as to whether you can use it for a commercial site that doesn't involve shopping or banking though.

I did read their terms, which is why I posted that. Nowhere does it say that you can't use the free certificate for a company. In fact if you read their FAQ ("The certificate is for my company, what shall I do?") it says "even in case he/she decides to obtain certification as an employee or representative of an organization". So it is specifically saying that you can use it for a company website. Also it doesn't say…

@cpncrunch, you need to re-read section 3.1.2.1 of StartSSL's policy:

  Class 1 certificates are limited to client and server
  certificates, whereas the later is restricted in its usage for
  non-commercial purpose only. Subscribers MUST upgrade to Class
  2 or higher level for any domain and site of commercial nature,
  when using high-profile brands and names or if involved in
  obtaining or relaying sensitive information such as health
  records, financial details, personal information etc.
That said, if you're a business, you pay $60 to get verified for a year, and then you can create as many certificates as you want.

Re: Switch to HTTPS Now, For Free

#259

Post by jbrechtel »

uxp wrote: post #133
jbrechtel wrote: post #84

Earlier quoted context omitted.

That's not true. Why do you think that?

Actually it is, because you'd still have a domain pointed to an IP address listening on 443, and that IP address wouldn't know how to handle the domain that is not configured to listen on 443, so it would serve the default domain (generally the first SSL-configured domain with Apache, or 'default_server' on Nginx). This means you'll be serving a certificate for your default site 'foo.com' when you requested 'bar.org'…

I don't think it's at all obvious or universally true that it's better to get an 'Unable to connect' error message than a certificate warning (btw, the default site could tell the user they arrived there by accident should they continue past the warning). Depends on the context.

I'd still say it's definitely not true that you "have to" get an SSL cert for all virtual-hosted domains on one IP address if that IP address is responding to SSL requests on 443.

Re: Switch to HTTPS Now, For Free

#260

Post by jbrechtel »

chrismorgan wrote: post #127
jbrechtel wrote: post #86

Earlier quoted context omitted.

Why's this a problem related to SSL?

Without SNI, SSL works on an IP address level rather than a hostname level, just like HTTP/1.0 worked at the IP address level and HTTP/1.1 works at the hostname level with the Host header. Read https://en.wikipedia.org/wiki/Server_Name_Indication for more info.

Sorry, I wasn't clear. I understand SNI and SSL without SNI.

What I'm not seeing is why it's a problem when a host such as DO doesn't allow multiple IP addresses on a single machine.

Is it because you may want to host multiple sites on that machine and use one IP address for SSL?

Oh, nevermind. It's because you may want to support multiple SSL sites on the same box without requiring your clients support SNI. That makes sense.

We really need to just EOL everyone who has a browser without SNI. People like to say that there's still a lot of XP users out there but surely even a reasonable chunk of them are using Chrome or Firefox with SNI support, right?

Post reply on HN