Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Still Why No HTTPS?

troyhunt.com

Post reply on HN
Print view View original

291–300 of 345 posts

Re: Still Why No HTTPS?

#291

Post by dylz »

pcmonk wrote: post #35
iudqnolq wrote: post #22

Earlier quoted context omitted.

Our asshat twin n-gate has something to say about this > Horseshit. Users must keep themselves safe. Software can't ever do that for you. Users are on their own to ensure they use a quality web client, on a computer they're reasonably sure is well-maintained, over an internet connection that is not run by people who hate them. None of the packets I send out are unsafe, so my site does not need HTTPS. > None of those…

Can't read the article because the captcha won't load, but this reply doesn't make any sense. What can the browsers do without the cooperation of the server? You don't really need encryption to deal with that specific problem, but you do need signatures, which means you need a certificate anyway. It's quite a strange attitude toward the problem.

There is no captcha. It's a fake page meant to harass certain referrers.

Re: Still Why No HTTPS?

#292

Post by xvector »

gmiller123456 wrote: post #279

1. The requirement to involve a 3rd party certificate authority is a needless power grab. Giving in ends the hope that it will ever get changed. 2. There is currently only one free cert provider, if there are ever issues with it, your users will see a scary error message which will make them think there are security issued with your website. 3. Downloading and running code from a 4th, or 5th party and giving it acces…

> The requirement to involve a 3rd party certificate authority is a needless power grab. Giving in ends the hope that it will ever get changed.

Genuinely curious - what alternatives do you have in mind? Are there any WoT models that interest you more?

> There is currently only one free cert provider, if there are ever issues with it, your users will see a scary error message

Isn't this the point?

> Downloading and running code from a 4th, or 5th party and giving it access to your config files is not "more secure".

Could you elaborate? Have you written your whole stack from scratch? You are running millions of lines of code that you will never read but have been implemented by other parties.

> HTTPS is needlessly complex making it hard to implement.

Isn't this done with robust battle-tested libraries and built-in support in modern languages?

---

Mainly I'm just wondering why you're letting perfect be the enemy of good. There's always room for improvement in everything, but I don't think user privacy is a reasonable sacrifice to make.

> Giving in ends the hope that it will ever get changed.

Abstaining from HTTPS won't be seen by anyone as a protest, but as incompetency, whether you find that justifiable or not.

Re: Still Why No HTTPS?

#293

Post by reaperducer »

gmiller123456 wrote: post #279

1. The requirement to involve a 3rd party certificate authority is a needless power grab. Giving in ends the hope that it will ever get changed. 2. There is currently only one free cert provider, if there are ever issues with it, your users will see a scary error message which will make them think there are security issued with your website. 3. Downloading and running code from a 4th, or 5th party and giving it acces…

4. The culture of fear around HTTPS, meaning only the "most secure" or "newest" protocols and cipher suites are to be used. This prevents older clients from working, where HTTP works just fine.

This is important. I have several devices at home that cannot display many web sites because they don't have the ability to use latest ciphers.

Re: Still Why No HTTPS?

#294

Post by discreditable »

necovek wrote: post #290

My biggest gripe with the current de facto recommended approach (even mandated in HSTS) is that you need to redirect to https from untrusted http. So you are being forced to either not serve http, or to condition users to trust MITM-able redirect. How many people will notice a typoed redirect to an https page with a good certificate? The solution is simple: browsers should default to https, and fall back to http if u…

Annoyingly, if you want to get a let's encrypt cert you have to serve http. Back when I was manually purchasing & installing certs I didn't even listen on 80 for several services.

(Exception being if you use the dns challenge)

Re: Still Why No HTTPS?

#295

Post by slim »

gmiller123456 wrote: post #279

1. The requirement to involve a 3rd party certificate authority is a needless power grab. Giving in ends the hope that it will ever get changed. 2. There is currently only one free cert provider, if there are ever issues with it, your users will see a scary error message which will make them think there are security issued with your website. 3. Downloading and running code from a 4th, or 5th party and giving it acces…

7. it breaks caching proxies

Re: Still Why No HTTPS?

#296

Post by driverdan »

reaperducer wrote: post #293
gmiller123456 wrote: post #279

1. The requirement to involve a 3rd party certificate authority is a needless power grab. Giving in ends the hope that it will ever get changed. 2. There is currently only one free cert provider, if there are ever issues with it, your users will see a scary error message which will make them think there are security issued with your website. 3. Downloading and running code from a 4th, or 5th party and giving it acces…

4. The culture of fear around HTTPS, meaning only the "most secure" or "newest" protocols and cipher suites are to be used. This prevents older clients from working, where HTTP works just fine. This is important. I have several devices at home that cannot display many web sites because they don't have the ability to use latest ciphers.

Don't buy computing devices that don't give you root.

Re: Still Why No HTTPS?

#297

Post by Sohcahtoa82 »

anony121212 wrote: post #251
pornel wrote: post #239

Earlier quoted context omitted.

https://doesmysiteneedhttps.com/ MITM can do anything to your site, so your totally-static site may not be static any more at the victim's end. It may be a site collecting private details, attacking the browser, or using the victim to attack other sites. Your static HTTP site is a network vulnerability and a blank slate for the attacker.

So then disable javascript for http sites

That won't do anything. If someone can Man-in-the-Middle you, then they can easily forge a 302 redirection to a malicious web page that could be HTTPS.

Re: Still Why No HTTPS?

#298

Post by driverdan »

namibj wrote: post #27

There is one "good" reason against https: handshakes take enormous amounts of CPU, relatively speaking. It's quite easy tp DoS server by skipping the expensive part on your end. You can load a core with 10~30Mbit@2k rps if your not even optimized. Whereas the same server could tank 40k rps HTTP requests.

Assuming this is true 2000rps per CPU core seems pretty reasonable. That would only be a bottleneck when serving static files. Only the most basic apps are going to be able to serve that much traffic per core.

Re: Still Why No HTTPS?

#299

Post by tooMuchCensor »

xvector wrote: post #292
gmiller123456 wrote: post #279

1. The requirement to involve a 3rd party certificate authority is a needless power grab. Giving in ends the hope that it will ever get changed. 2. There is currently only one free cert provider, if there are ever issues with it, your users will see a scary error message which will make them think there are security issued with your website. 3. Downloading and running code from a 4th, or 5th party and giving it acces…

> The requirement to involve a 3rd party certificate authority is a needless power grab. Giving in ends the hope that it will ever get changed. Genuinely curious - what alternatives do you have in mind? Are there any WoT models that interest you more? > There is currently only one free cert provider, if there are ever issues with it, your users will see a scary error message Isn't this the point? > Downloading and ru…

Incompetency could be it. My website was down for a weekend, a thousand people got a dead website.

I imagine if anyone other than a nerd was running our non profit website, if they'd always have the warning message.

Re: Still Why No HTTPS?

#300

Post by amaranth »

gambler wrote: post #248
UI_at_80x24 wrote: post #167

Earlier quoted context omitted.

>go through all that hustle.... I manage 100+ servers, hosting a significantly larger number of domains, on a variety of linux and FreeBSD operating systems. Under both Apache & Nginx. "..all of that hustle.." to initially setup is under 2 minutes with LetsEncrypt. The renewal (via a cron job) is completely out-of-sight/out-of-mind. The execution is shockingly simple. If you think it's "all that hassle" I guarantee y…

>The execution is shockingly simple. Only if you're blindly running shell commands the effects of which you don't understand.

Have you audited the source code of everything running on your computer? If not then you've had to trust that people aren't being evil or that someone is doing that checking for you. Why is this any different?
Post reply on HN