Live data from Hacker News

Deprecating Non-Secure HTTP

blog.mozilla.org

261–270 of 318 posts

Re: Deprecating Non-Secure HTTP

#261
Please, can we stop calling it SSL?

SSL means something very specific; something that people should no longer be deploying. The article notably uses the term 'Non-secure HTTP' which at this point in time means HTTPS leveraging TLS (probably at least 1.2) but leaves some room for future interpretation as newer versions or entirely different standards arise.

No one is advocating for 'SSL' here, and continuing to use the term 'SSL' or 'SSL/TLS' when we really mean 'TLS' further confuses the situation.

Re: Deprecating Non-Secure HTTP

#262
post #187

Earlier quoted context omitted.

> It's as basic as having an SSH or PGP key. And you're surprised that not every developer has done this? A minority of the developers I've ever worked with have ever done any of these things.

I'm really talking about the kind of developers that hang out here—people who regularly set up their own staging environments, use those "tunnel into my dev box" services, etc. Most of us here certainly know SSH, and probably have used GnuPG at least once. But it's still relatively unlikely, statistically, that you or I have ever touched the openssl(1) command.

Well, when we are talking about a change in Firefox, we are talking about every developer, not just the ones who hang out on HN.

Re: Deprecating Non-Secure HTTP

#263
post #258

Earlier quoted context omitted.

For example, I need IP-only certs for a new project I'm working on (waiting for DNS to propagate to all clients is too unreliable and slow). This doesn't make any sense. You're not waiting for DNS to propagate to clients; if anything you're waiting for recursive DNS servers at shitty ISPs to time out their caches when they are configured to not honor the RR's TTL sent by the authoritative server in a misguided attemp…

How often are DNS caches configured to ignore TTLs? That sounds awful. I assumed the grandparent simply didn't understand the need to lower his TTLs.

Google DNS seems to ignore TTL but it does the opposite of what the GP is saying; gDNS drops it cache before the TTL is expired.

Re: Deprecating Non-Secure HTTP

#264
I think there are some issues here.

Browser vendors have indirectly created the money sucking machine that is the certification industry by requiring potential root CAs to have been audited to a very thorough standard (e.g. WebTrust).[0] Most of these audits implicitly require dedicated premises, extreme physical security measures, dedicated hardware, multiple dedicated uplinks, 24x7 personnel, and more. Even browsers that don't use their own cert store prop up this system by using the OS store which does require said audits. (And if anyone doubts how instrumental the browsers are to the continuance of this system, imagine how relatively niche the X509 industry would become if they moved to using something else.) As anyone who has tried to grok the documents at [0] will attest, it's a damn scary thing. Honestly you may as well try to start a bank. Or a country.

This level of difficulty creates a monopoly (or oligopoly, to be more precise.) Few people have the will/finance to do it so few do, and those who do get to take the piss with pricing. As I previously wrote[1], this means FOUR companies control the CAs that issue 91% of ALL the internet's TLS certificates.

LetsEncrypt seems like a good thing, and it might be, but it also might not be. It is, underneath all the PR, pretty much just another root CA who holds itself to the same auditing standards. It is no-doubt a very expensive undertaking and as such we may reasonably assume that there will be few, if any, additional zero-cost, fully-supported CAs in the future: and herein lies one problem. Unless you have specific requirements that LetsEncrypt just doesn't support, you have no reason not to use them. So a future CA landscape might be ONE company controlling 99% of the internet's secrets. Oh dear.

What's more, we should not underestimate the importance of cheap shared hosting. The internet is a medium for information and nothing more, and everybody has something that they might wish to broadcast. Currently, deprecating vanilla HTTP is akin to deprecating the ideas of millions of non-experts who rely on shared hosting to participate. We're telling them to join us in the land of VPSs and terminal emulators/Plesk (shudder), or to use one of the many PaaS services we've created over their own homemade solution. This is fundamentally anti-technology, which is supposed to harness innovation and make lives easier. This point is especially pertinent when you consider that the vast majority of these sites probably don't need encryption at all, so it's not even like you can mitigate the pain with direct benefits - because there are none.

Finally, TLS is a pain in the arse to administer. Really - it's not fun. I'm no stranger to it, and even I get a bit of a sinking feeling when it has to be done. To this day I'm bound to using Chrome, because no matter what I do I cannot get Firefox to parse (never mind accept) my NAS's self-signed cert. Requiring TLS across the board is tantamount to requiring many millions of hours of pain across the world.

To hold up some moral torch that does not have universal applicability and actively makes life difficult, and then declare it as canonical truth that all must adhere to is arrogance of the highest order. A great deal of chat in the tech community is dedicated to lambasting short-sighted and ill-conceived laws (think surveillance, copyright, patents, etc.) and yet here we are, making them. We have to do better.

    [0]: http://www.webtrust.org/homepage-documents/item27839.aspx
    [1]: http://lorddoig.svbtle.com/heartbleed-should-bleed-x509-to-death

Re: Deprecating Non-Secure HTTP

#265

Earlier quoted context omitted.

I'm a person who actually deploys .net apps to internal IIS QA servers. If I want them to use HTTPS, I have to configure it. I don't know anything about my own CA certificates. I'm not saying it couldn't happen, but it's certainly easier to suggest just not using firefox if something isn't working.

So you handle deployment of apps inside a corporate network, and have no idea on how to manage you own CA? How does you corporation handle actually important corporate sites that nobody must access? It sound to my like your corp has some issues on this side.

I don't deal with public facing servers. You're right. We may have issues, but I don't know how it's handled.

Re: Deprecating Non-Secure HTTP

#266
post #231

Earlier quoted context omitted.

Say the owner of a website with a self-signed cert fears it might have been compromised, and decides to create a new cert. How is the user supposed to distinguish that from a MITM?

That's what the central hash servers are for. Am I being MITM'd? Well, ignoring a global adversary, the problem is usually local. But CA's don't solve the global problem either.

Wouldn't you have to tell the central servers about each and every site you visited?

Re: Deprecating Non-Secure HTTP

#267
I have a small blog on a home server. Basic HTML and static content and I don't care who views it. I can't get a static IP address.

Some things about this decisions doesn't seem thought out. -who regulates the companies selling certificates? ($5 for a cert seems shady), are cert companies fronts for others entities? -does this really prevent malware? -will self signed certificates get a bit more respect? -how does this stop Lenovo from adding preinstalled malware that circumvents security certificates?

Re: Deprecating Non-Secure HTTP

#268

Please, can we stop calling it SSL? SSL means something very specific; something that people should no longer be deploying. The article notably uses the term 'Non-secure HTTP' which at this point in time means HTTPS leveraging TLS (probably at least 1.2) but leaves some room for future interpretation as newer versions or entirely different standards arise. No one is advocating for 'SSL' here, and continuing to use th…

It's not that specific. You could even negotiate a downgrade with a TLS server to use SSL. The first 3 versions of the protocol were named SSL and the later ones were named TLS but they're not really different.

Re: Deprecating Non-Secure HTTP

#269
I understand that http will still be supported but downgraded by both Mozilla's browser and Google search. How about distinguishing websites that are only static content, and websites that have some forms, or dynamic content.

Re: Deprecating Non-Secure HTTP

#270

I agree with trying to phase out HTTP, but I think their method is "annoying." What do features have to do with HTTP Vs. HTTPS? It just seems like an arbitrary punishment. Wouldn't it just be significantly easier to simply change the URL art style to make clear that HTTP is "insecure." Like a red broken padlock on every HTTP page? That has the following advantages: - HTTP remains fully working for internal/developmen…

The actions Mozilla proposes sound awful. I believe that a secure (from the NSA) Internet is the way forward. But this seems so goofy to me. There are legitimate reasons for a site not to be hosted on HTTPS. * It is a static site with no forms or logins * It is non-critical info * The site operator can't afford a certificate (Let's Encrypt is only one site...) As you say: Color-code sites with a bit more granularity.…

Regardless how static a site is attackers are free to inject any script code they wish in the HTML page on Http.
Post reply on HN