Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Will Soon Shame All Websites That Are Unencrypted

motherboard.vice.com

Post reply on HN
Print view View original

261–270 of 369 posts

Re: Google Will Soon Shame All Websites That Are Unencrypted

#261

Post by rspeer »

cellularmitosis wrote: post #163
schoen wrote: post #154

Earlier quoted context omitted.

If you don't have a way to confirm that the key you're seeing from the other site is right, you're inherently vulnerable to a man-in-the-middle attack which removes the benefits of the encryption against the attacker. https://en.wikipedia.org/wiki/Man-in-the-middle_attack httpS://en.wikipedia.org/wiki/Zooko's_triangle It's not clear that the certificate authority system was or is the best solution to this problem, bu…

However, having one and not the other isn't totally useless. Having the browser be able to track and tell me that "Though we aren't sure this is actually google.com, we do know that the exact same cert has been used the last 50 times you visited this website" is something I'd consider to be useful. (Actually, telling me if it changes would be the useful bit). That would be at least be useful for self-signed certs (th…

> (Actually, telling me if it changes would be the useful bit).

I'm curious. Has anyone ever encountered that scary warning you get when an SSH host key changes, and thought "oh man, I'm getting MITMed, I'd better not connect to this server!", instead of thinking "oh right, I guess they reconfigured the server, now what command do I type to make the warning go away"?

Re: Google Will Soon Shame All Websites That Are Unencrypted

#262

Post by geofft »

drdaeman wrote: post #140
geofft wrote: post #110

Earlier quoted context omitted.

I don't currently see a 500 ms difference, so maybe they figured something out. From my shell, I see about 35 ms to http://www.stavros.io/404 and about 85 ms to https://www.stavros.io/404 (the HTTPS site serves actual content and the HTTP a redirect, which confounds the numbers). The HTTPS server is currently offering me a 4096-bit-RSA certificate, signed by the 2048-bit-RSA StartCom class 1 intermediate CA. There's…

Currently I see ~200ms difference (repeated those tests a good number of times, of course, those are results closest to average): $ time curl -4 -s -o /dev/null https://drdaeman.pp.ru curl -4 -s -o /dev/null https://drdaeman.pp.ru 0.00s user 0.00s system 2% cpu 0.300 total $ time curl -4 -s -o /dev/null http://drdaeman.pp.ru curl -4 -s -o /dev/null http://drdaeman.pp.ru 0.00s user 0.00s system 7% cpu 0.107 total The…

> I'm also using 4Kbit RSA keys, maybe that's the cause, especially given that the server is a tiny Atom HTPC sitting in the kitchen

Yeah, the combination of those two things is very likely to not do you any favors.

It is worth clarifying that Google et al.'s claim that SSL is essentially no overhead is conditioned on the assumption that you're using reasonably modern and full-featured processors, especially with AES-GCM in hardware. (Which is pretty common on laptop processors these days even without trying hard to find it, but probably won't be on an Atom HTPC.) I think that's reasonable, since if you're seriously worried about performance and latency, you're probably starting off with good hardware, and your worry is that investment will go to waste if you turn on SSL. At least for running a web server for fun on an old personal machine, the added latency is real and is unfortunate but I'd guess also not such a big deal. But maybe that's a bad assumption?

Re: Google Will Soon Shame All Websites That Are Unencrypted

#263

Post by Vendan »

ergothus wrote: post #66
gesman wrote: post #26

Google should offer stupid SSL certificates either for free or for $1/yr. Perhaps at least to customers of Google domains. I won't mind switching from namecheap to Google domain in latter case.

Getting a Google domain means giving up getting new features from Google :( (pauses to clean up bitterness)

Note that by default, Google apps stuff is on a delayed schedule compared to the general public, but you can go into your google apps profile and change to the "Rapid Release" feature deployment, which means you get stuff as soon as the general public does.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#264

Post by gaadd33 »

BinaryIdiot wrote: post #161
callmeed wrote: post #156

Consider this: - Squarespace doesn't support SSL (other than on their ecommerce checkout pages) [1] - Weebly only allows it on their $25/mo business plan [2] - Wordpress.com doesn't support SSL for sites with custom domains [3] - If you've never experienced the process of requesting, purchasing, and then installing an SSL certificate using a hosting control panel like Plesk or cPanel, let me tell you–it's a nightmare…

Yeah I'm all for SSL shaming but my personal site with SquareSpace is about to look like shit for me since I'm a web developer. I mean as a web developer it's not going to look good if your portfolio is shown with a security warning. I wonder if SquareSpace is going to finally fix their shit or if I'm going to have to move elsewhere which is going to be a pain (I went with SquareSpace because I didn't want to be asse…

Why not just put your SquareSpace site behind Cloudflare? Then you get free SSL.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#265

Post by tomjen3 »

CydeWeys wrote: post #97
eyuelt wrote: post #91

Earlier quoted context omitted.

Sure they can. Your ISP can easily MitM you.

Not without throwing cert errors on every site I visit. The only way they can MITM me is if they compromise my PC as well and install their root CA.

To connect to the internet you must install comcast internet-enhancing-certificate. It's the only way to make all websites secure by default™

No reason to compromise when you can force the user.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#266

Post by tyingq »

Dylan16807 wrote: post #249
tyingq wrote: post #111

Earlier quoted context omitted.

This is also effectively true for the more broadly used Google Adsense (not just DFP). They do support displaying adsense, but then screen out all non-https ads. Which, of course, results in a lower CPM.[1] [1] https://support.google.com/adsense/answer/10528?hl=en >>In short; Google will penalize me because I use Google +++

To be fair, sites without ads are a better experience than sites with ads.

Sure. I like free things as well.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#267

Post by tomjen3 »

rspeer wrote: post #261
cellularmitosis wrote: post #163

Earlier quoted context omitted.

However, having one and not the other isn't totally useless. Having the browser be able to track and tell me that "Though we aren't sure this is actually google.com, we do know that the exact same cert has been used the last 50 times you visited this website" is something I'd consider to be useful. (Actually, telling me if it changes would be the useful bit). That would be at least be useful for self-signed certs (th…

> (Actually, telling me if it changes would be the useful bit). I'm curious. Has anyone ever encountered that scary warning you get when an SSH host key changes, and thought "oh man, I'm getting MITMed, I'd better not connect to this server!", instead of thinking "oh right, I guess they reconfigured the server, now what command do I type to make the warning go away"?

I have. Usually it's because i reconfigured the server, but I am ultra paranoid. Most people don't care, but I would expect sysadmins to do so. And who else should login with ssh?

Re: Google Will Soon Shame All Websites That Are Unencrypted

#268

Post by mynameisvlad »

windsurfer wrote: post #185
bobby_9x wrote: post #62

Earlier quoted context omitted.

..so why are all of the search terms suddenly gone from google searche referer headers? Which happened at the same time google defaulted to https?

Did you read the page I linked to? My referer was https://encrypted.google.com/search?hl=en&q=What%20Is%20My%2...

Uh, the referrer is the page you came from. So if he opened the page on HN, then he wouldn't get the Google referrer, he'd get a page off HN.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#269

Post by lambau »

icebraining wrote: post #174
callmeed wrote: post #156

Consider this: - Squarespace doesn't support SSL (other than on their ecommerce checkout pages) [1] - Weebly only allows it on their $25/mo business plan [2] - Wordpress.com doesn't support SSL for sites with custom domains [3] - If you've never experienced the process of requesting, purchasing, and then installing an SSL certificate using a hosting control panel like Plesk or cPanel, let me tell you–it's a nightmare…

Then maybe those platforms will finally implement it. In any case, there's an alternative: putting Cloudflare in front of the site. In fact, Google shows me a guide to do so when I search for "squarespace ssl". Of course, that's hardly as secure as end-to-end HTTPS, but still, I trust the path between CF and SquareSpace much more than between the user's browser and SquareSpace.

Please do not put Cloudflare in front of your site. It makes it impossible for tor and VPN users to view your site since they have to solve an impossible captcha to even see the static content.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#270

Post by nitrogen »

userbinator wrote: post #258

The article title really, really needs an extra word: "Chrome", between "Google" and "Will". At first glance I thought it would be about the search engine, which would be a very disturbing thought indeed; it's already hard enough to find the older, highly informative and friendly sites --- which often are plain HTTP. Nevertheless, quite convincing security arguments aside, I feel this also has a very authoritarian si…

What we really need is opportunistic unauthenticated encryption with key pinning as a fallback between CA-signed https and plain http. Beating mass passive snooping is worthwhile even if MITM is still a risk.
Post reply on HN