Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Still Why No HTTPS?

troyhunt.com

Post reply on HN
Print view View original

261–270 of 345 posts

Re: Still Why No HTTPS?

#261

Post by zzo38computer »

cesarb wrote: post #46
WilliamEdward wrote: post #4

Some websites adamantly insist they did not need HTTPS because they are purely static. https://www.troyhunt.com/heres-why-your-static-website-needs... The same website to my surprise has an article on why this is faulty reasoning.

Though I'm on the "encrypt all the things!" camp, let me play devil's advocate for a moment. If I set up a purely static HTTP-only site in 1998, it would still work with today's browsers, more than 20 years later. If I set up a purely static HTTPS-only site in 1998, and didn't follow the upgrade treadmill, it would have stopped working for modern browsers some time ago.

That is (at least one reason) why you should implement both, instead of just one.

Re: Still Why No HTTPS?

#262

Post by rconti »

UI_at_80x24 wrote: post #167
dm33tri wrote: post #144

Why do browsers punish non-verified certs much harder than no-cert? If I want to quickly host my page and use encryption, then I have go through all that hustle to make it work. Perhaps allow use of self-signed certificates on same level as http instead of blocking my website.

>go through all that hustle.... I manage 100+ servers, hosting a significantly larger number of domains, on a variety of linux and FreeBSD operating systems. Under both Apache & Nginx. "..all of that hustle.." to initially setup is under 2 minutes with LetsEncrypt. The renewal (via a cron job) is completely out-of-sight/out-of-mind. The execution is shockingly simple. If you think it's "all that hassle" I guarantee y…

If you think this is "shockingly simple", I'd like to hear from you again in 10 years as your environment has grown, as your number of operating systems explodes, as you have to deal with restrictive network policies, as LetsEncrypt has been replaced a few times with new up-and-coming latest-and-greatest solutions, as bugs have been found, as clocks have skewed, as domain ownership rules have changed, as domain ownership verification policies have changed a half dozen times...

If you think something is set-it-and-forget-it, you haven't been around long enough.

Re: Still Why No HTTPS?

#263

Post by vivekd »

One thing that surprised me was how hard it was to set up https https redirects for websites on aws and Google cloud. I needed too set up a load balancer to do https.

The redirects are also hard, I have a static site using Google storage and I have to create a server instance and redirect from there because it's not possible to do an automatic redirect. I don't know why the big cloud hosting providers aren't cooperating to make full https implementation easier.

Re: Still Why No HTTPS?

#264

Post by JackRabbitSlim »

couchand wrote: post #146
dm33tri wrote: post #144

Why do browsers punish non-verified certs much harder than no-cert? If I want to quickly host my page and use encryption, then I have go through all that hustle to make it work. Perhaps allow use of self-signed certificates on same level as http instead of blocking my website.

One reason that comes to mind immediately: self-signed certificates offer no protection against MITM attacks. It's worse than without a cert, since it gives a false sense of security.

Which CAs have never been subject to a National Security letter? Can't say cuz you can't know? Lets talk about that false sense of security indeed.

Re: Still Why No HTTPS?

#265

Post by mminer237 »

bullen wrote: post #252

Downvote time: Why HTTPS? I made my own security: http://talk.binarytask.com

It encrypts traffic to prevent others from reading, modifying, or replacing requested responses? What is your security? I don't see a reason that your site wouldn't be vulnerable to a MITM attack.

Re: Still Why No HTTPS?

#266

Post by comboy »

zzzcpan wrote: post #240
allset_ wrote: post #238

Earlier quoted context omitted.

Everything in your comment has to do with general server maintenance, and is not specific to automating certificate renewal with certbot or a similar tool which is what is being discussed. Adding HTTPS to your site and setting up automatic renewal is literally three steps on an Ubuntu system and you can copy and paste it from the certbot documentation [1]. [1] https://certbot.eff.org/lets-encrypt/ubuntubionic-nginx

Dealing with certificates is more critical than "general server maintenance", things people often neglect doing suddenly become required. It might take from a few months to even a couple of years to get from neglected infrastructure to infrastructure ready for reliable automated issuance of certificates. I actually evaluated a bunch of acme clients, wasn't satisfied with the code of any of them and wrote my own. But…

It sounds like you are super critical about any potential security issues (because what else could it be, other than that it just works or it doesn't). If given machine security is super important (oh it's running a web server..), then why not just run certbot elsewhere and sync the files in a manner that satisfies your security needs?

Re: Still Why No HTTPS?

#267

Post by exhilaration »

fpgaminer wrote: post #220
exhilaration wrote: post #209

Earlier quoted context omitted.

So here's how I do it for internal network devices. I have a RaspberryPi running on 192.168.100.1 on my local network. On https://www.duckdns.org/ or whatever your favorite DNS provider is, I signed up for a free account and created myRaspberryPi.duckdns.org and pointed it to 192.168.100.1. While you're logged in, grab the DuckDNS API key. Next you need to use ACME or Caddy (I use the latter) and tell it to do the Le…

Wouldn't this be subject to Let's Encrypt's rate limit of 50 certs per week for duckdns.org? Do they have an exception or are not enough people using this trick for it be a problem (yet)?

That is a really good point that I didn't consider.

Re: Still Why No HTTPS?

#268

Post by AnIdiotOnTheNet »

AndrewStephens wrote: post #185
enriquto wrote: post #128

Earlier quoted context omitted.

my static website is a sand castle in the beach. When I'm not around, kids may break it, or a random person may impersonate as its creator. That is alright, it is just a sand castle. The only purpose of its existence is to provide casual onlookers a nice view (or read) for a few minutes. Having to set up a "certificate" for that would be an unacceptable burden.

It is a sand castle on a private beach owned by you. Have you ever posted a link to your site anywhere? Imagine you sent me a post card saying "Come to my beach to look at my cool sandcastle" and then when I got there the sandcastle was actually a robot that stole my credit card. You could say that it wasn't your fault - somebody broke into your private beach and replaced the sandcastle. But I would probably still bl…

> and then when I got there the sandcastle was actually a robot that stole my credit card.

What kind of moron shows up to see a sandcastle and doesn't think twice about handing over their credit card?

Re: Still Why No HTTPS?

#269

Post by ivanbakel »

mrob wrote: post #234
yencabulator wrote: post #224

Earlier quoted context omitted.

The http version can't access secure cookies; https with the wrong cert can use the secure cookies of the real https site.

So disable secure cookies by default for self-signed certs. The scary warnings can be shown when the user tries to enable them.

In other words, "open users up to social engineering attacks to make my web-dev life easier".

Re: Still Why No HTTPS?

#270

Post by arminiusreturns »

JackRabbitSlim wrote: post #264
couchand wrote: post #146

Earlier quoted context omitted.

One reason that comes to mind immediately: self-signed certificates offer no protection against MITM attacks. It's worse than without a cert, since it gives a false sense of security.

Which CAs have never been subject to a National Security letter? Can't say cuz you can't know? Lets talk about that false sense of security indeed.

Yep, for years when everyone was talking about NSL's and other corporate strong-arming by the gov, I started saying I suspect most major CA's are compromised. At least you know your threat model though, because only the nation states are going to have that.

CA's and DNS are two parts of the internet that have become way too centralized in my opinion.

Post reply on HN