Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Will Soon Shame All Websites That Are Unencrypted

motherboard.vice.com

Post reply on HN
Print view View original

291–300 of 369 posts

Re: Google Will Soon Shame All Websites That Are Unencrypted

#291

Post by imtringued »

nostalgiac wrote: post #288
nodamage wrote: post #230

Earlier quoted context omitted.

> I do have the app. And that fact makes this double-annoying. It really just shows the sad state of mobile advertising when they're showing you ads for an app you already have.

Sad state? How do you expecet them to know all the apps installed on your phone? And if they DID know this information, people would be up in arms about privacy or lack there-of.

It's google. They know that you downloaded the app from the Play Store and used the app to connect to their servers directly. They already have plenty of information.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#292

Post by kuschku »

userbinator wrote: post #258

The article title really, really needs an extra word: "Chrome", between "Google" and "Will". At first glance I thought it would be about the search engine, which would be a very disturbing thought indeed; it's already hard enough to find the older, highly informative and friendly sites --- which often are plain HTTP. Nevertheless, quite convincing security arguments aside, I feel this also has a very authoritarian si…

Regarding the censorship:

It's obvious that censorship by western governments is never considered "censorship".

Only the evil enemy censors, we just have to enforce laws.

If one accepts this argument, it makes sense to argue that giving CAs more power is good — because, obviously, they don't censor, they just protect the interests of our economy.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#293

Post by josteink »

serge2k wrote: post #21
josteink wrote: post #9

Yeah. Still not paying for a cert on my person home-pages just so I can have my own page come up first when people google my (worldwide unique) name. That page contains static HTML and does not need SSL, and it's not "insecure" just because you may be on a network which MITMs traffic. That makes your network insecure, not my page. So yeah. Not interesting. Not worth it.

> Still not paying for a cert on my person home-pages lets encrypt?

That means moving to a webhost and plan which supports SSL. They are usually more expensive. It's not just getting the cert.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#294

Post by agildehaus »

frik wrote: post #279

HTTP + HTTPS is fine HTTPS for SaaS and e-commerce web apps is fine HTTP for normal websites is okay (for me, I have no hidden agenda) HTTPS-only for normal websites is silly, why not offer HTTP too? Every request is unique, no internet anonymity.

Why is HTTPS-only for normal websites silly? It ensures the page was not tampered with enroute.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#296

Post by frik »

agildehaus wrote: post #294
frik wrote: post #279

HTTP + HTTPS is fine HTTPS for SaaS and e-commerce web apps is fine HTTP for normal websites is okay (for me, I have no hidden agenda) HTTPS-only for normal websites is silly, why not offer HTTP too? Every request is unique, no internet anonymity.

Why is HTTPS-only for normal websites silly? It ensures the page was not tampered with enroute.

Why not HTTP + HTTPS? Let the user decide. HTTPS-only is silly for normal websites. Visitors from cooperate networks or some countries would say, your second sentense doesn't hold in the real world.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#297

Post by lambau »

ryanlol wrote: post #282
mintplant wrote: post #278

Earlier quoted context omitted.

It's possible to turn off security in the CloudFlare control panel. I think the bigger issue is that CloudFlare has become a single point of interception for MITM'ing huge portions of web traffic.

I'm not sure, but I think CloudFlare will still hit Tor users with (unsolvable) captchas even with the lowest security settings. But yeah, this NSA slide is extremely relevant to cloudflare: http://cdn01.androidauthority.net/wp-content/uploads/2014/06...

> I think CloudFlare will still hit Tor users with (unsolvable) captchas even with the lowest security settings.

That is correct. I have not been able to get passed a Cloudflare captcha over tor for any website.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#298

Post by michaelt »

SystemOut wrote: post #216
donohoe wrote: post #64

Which is hilarious because the reason I can't switch The New Yorker website to HTTPS is because of ads - which I'm getting from Google DFP which allows non-secure ad assets. In short; Google will penalize me because I use Google. The universe has a sense of humor.

Google DFP allows it because publishers (e.g. the New Yorker) aren't ready to switch all their traffic HTTPS. If they wanted to they could turn the switch and be HTTPS and tell DFP to only serve secure creatives. One of the larger difficulties for publishers is that many of the 3rd party SSPs aren't ready to go full HTTPs and so publishers are reluctant to make the switch because it reduces demand sources. Disclaimer…

  One of the larger difficulties for publishers is that
  many of the 3rd party SSPs aren't ready to go full HTTPs
Right, but Google can motivate or improve the third-party advertisers to update much more effectively than publishers can - just Google hasn't chosen to do that yet.

It would be easy to proxy http-only ads from through a CDN that added encryption. Or to charge a premium to http-only ad networks, and ramp the premium up over time.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#299

Post by lambau »

userbinator wrote: post #258

The article title really, really needs an extra word: "Chrome", between "Google" and "Will". At first glance I thought it would be about the search engine, which would be a very disturbing thought indeed; it's already hard enough to find the older, highly informative and friendly sites --- which often are plain HTTP. Nevertheless, quite convincing security arguments aside, I feel this also has a very authoritarian si…

Tor is a tool for circumventing censorship. HTTPS is an important part of using Tor to surf the web: 1) it protects the user from bad exits that could inject malicious javascript into a page and 2) some exits refuse HTTP connections and only allow HTTPS.

Maybe HTTPS makes it easier to censor in theory, but in practice it helps fight censorship by enabling Tor.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#300

Post by lambau »

nitrogen wrote: post #270
userbinator wrote: post #258

The article title really, really needs an extra word: "Chrome", between "Google" and "Will". At first glance I thought it would be about the search engine, which would be a very disturbing thought indeed; it's already hard enough to find the older, highly informative and friendly sites --- which often are plain HTTP. Nevertheless, quite convincing security arguments aside, I feel this also has a very authoritarian si…

What we really need is opportunistic unauthenticated encryption with key pinning as a fallback between CA-signed https and plain http. Beating mass passive snooping is worthwhile even if MITM is still a risk.

I agree! There is TCPCrypt, for example: http://www.tcpcrypt.org/
Post reply on HN