Encrypted web traffic now exceeds 90% • Hacker News Board

Re: Encrypted web traffic now exceeds 90%

#31

Post by r1ch » Fri, Nov 01, 2019, 6:22 PM UTC

Jonnax wrote: post #11

Nice. Remember the days when IT professionals would exclaim that this was a bad idea? Seems like it's cyclical thing. DNS over HTTPS is now the big bad technology.

DoH /is/ a bad technology on a technical level. On a modern network DNS requests come in pretty much constantly and I've never seen so many DNS timeouts and slow lookups as when I tried running a DoH proxy for my LAN. The head of line blocking of HTTP / TCP is horrible and my router was running at 100% CPU with all the TLS overhead.

I'm all for authenticated and encrypted DNS but routing it over HTTPS is just a nasty hack.

Re: Encrypted web traffic now exceeds 90%

#32

Post by ravenstine » Fri, Nov 01, 2019, 6:23 PM UTC

jancsika wrote: post #29

To the 90%: if you've got nothing to hide then why are you encrypting your traffic?

Comcast.

Re: Encrypted web traffic now exceeds 90%

#33

Post by lowiqprogrammer » Fri, Nov 01, 2019, 6:24 PM UTC

This is awesome, just 5 years ago the numbers were reversed.

Re: Encrypted web traffic now exceeds 90%

#34

Post by philg_jr » Fri, Nov 01, 2019, 6:27 PM UTC

jancsika wrote: post #29

To the 90%: if you've got nothing to hide then why are you encrypting your traffic?

Probably sarcasm but...why shut the door when you're in the bathroom?

Re: Encrypted web traffic now exceeds 90%

#35

Post by atonse » Fri, Nov 01, 2019, 6:27 PM UTC

vbezhenar wrote: post #10

I wonder how many fuel is burned to power servers and browsers to constantly encrypt and decrypt data which could be transferred much more efficiently unencrypted.

Not much since all major processor vendors do this in hardware.

Many entities have published their numbers and overhead is in the low single digit percentage.

Re: Encrypted web traffic now exceeds 90%

#36

Post by toomuchtodo » Fri, Nov 01, 2019, 6:33 PM UTC

SlowRobotAhead wrote: post #16

JoshTriplett wrote: post #8

Earlier quoted context omitted.

If that doesn't work, there's also the argument that "credit card providers require it, and could stop you from taking credit cards until you fix it".

You're right, but didn't have to. This guy when he could get past being mad at me knew that was against the rules. Also even if it was allowed, no one wants to shop at a place that says Not Secure. Side topic, but I've been trying to explain to our terrible CFO for years that PCI / PCI DSS is a real thing. He thinks that's the type of regulation that only giant companies have to deal with.

Feel free to report your org to your merchant processor if necessary if you're not meeting compliance requirements and think you can get away with it without compromising yourself.

Re: Encrypted web traffic now exceeds 90%

#37

Post by gator-io » Fri, Nov 01, 2019, 6:34 PM UTC

chrisweekly wrote: post #2

Awesome! Any idea how much of that is attributable to LetsEncrypt and HTTPSEverywhere?

The whole reason we started tracking HTTPS vs HTTP was because of LetsEncrypt. Love that they broke the need to pay ridiculously overpriced fees to generate certs.

Re: Encrypted web traffic now exceeds 90%

#38

Post by smolder » Fri, Nov 01, 2019, 6:34 PM UTC

That's good. One structural issue with the internet down, many more to go. There is essentially no guarantee that cloud providers don't snoop through memory and steal your keys and sift through your data, for instance. There are just some big companies that we implicitly trust. Whenever the endpoint for encryption /decryption is under the control of a 3rd party, any guarantee of data safety isn't real. We have devices that constantly go out looking for new code to run, with proprietary blobs in firmware, which means they're 3rd party controllable. Control of the internet is in the hands of organizations that can't be held accountable for abuse of power over individuals.

I guess I'm just saying I don't have faith that a system (I'm talking about the intersection of technology, government, and business here) which puts so little power in the hands of individuals will do an adequate job of serving their interests in the long term.

Re: Encrypted web traffic now exceeds 90%

#39

Post by deaps » Fri, Nov 01, 2019, 6:35 PM UTC

a13n wrote: post #27

mikece wrote: post #20

Earlier quoted context omitted.

Is a LetsEncrypt certificate "just as secure" as other certs? I have to imagine the answer is "no" simply because LetsEncrypt is free and the other certs aren't -- what more do you get by paying for a cert?

It is just as secure, you get nothing more by paying.

So for my personal projects, I use lets encrypt. As far as I know (and I could be wrong now, haven't checked in a while) - their certs are only good for 3 months. Which is simple enough to get around - run a script on your box that updates the cert every 90 days automatically.

At work, we use a paid certificate that is good for a longer period of time (normally a year). So that's one benefit to paying, I suppose.

As far as encryption technologies and security, the traffic encrypted by a lets encrypt cert is just as secure as the traffic secured by a paid-for CA signed cert.

Re: Encrypted web traffic now exceeds 90%

#40

Post by sroussey » Fri, Nov 01, 2019, 6:36 PM UTC

aesh2Xa1 wrote: post #14

Jonnax wrote: post #11

Nice. Remember the days when IT professionals would exclaim that this was a bad idea? Seems like it's cyclical thing. DNS over HTTPS is now the big bad technology.

No, haha. When was that a thing?

Verizon used to tell people that until this year.