Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why HTTP without encryption and self-signed sertificates are OK

sininenankka.dy.fi

Post reply on HN
Print view View original

31–40 of 48 posts

Re: Why HTTP without encryption and self-signed sertificates are OK

#31

Post by KronisLV »

Sohcahtoa82 wrote: post #30

> There used to be a time when malicious websites usually didn't have encryption at all, or if they had, their certificate was self-signed. Let's Encrypt changed that. Now every malicious site has a certificate that appears trusted, and there will soon be a need of having different levels of "trust", where free-of-charge certificates like the ones from Let's Encrypt will become essentially untrusted. First off, this…

Perhaps less related to the original post, but I found this interesting:

> Let's Encrypt is such a huge part of the Internet now that I don't think browser vendors could decide to just stop trusting their certs. Even if they did, another free certificate vendor would appear and we'd be back at square one.

I wonder how come every large provider out there doesn't have their own free certificates in an attempt to compete with Let's Encrypt, get a piece of the free cert market share and possibly upsell their premium services in the process?

The only viable alternative to Let's Encrypt that I personally know of appears to be ZeroSSL: https://zerossl.com/

Though from what I can tell, they have a 3 free cert limitation, at least when provisioned through the website. Which actually seems like a decent attempt to encourage people to pay for their other products (and things like wildcard certificates).

Sure, many might just stick with Let's Encrypt, but why isn't every vendor out there doing the same thing?

Re: Why HTTP without encryption and self-signed sertificates are OK

#32

Post by 0x08 »

The biggest practical issue that I have with the author's advice is that most people just want to type domain.tld into a web browser. This will guarantee that most people will get the http version of the website which is not ideal. You'll get a large number of, you should add security to your site messages. Also, Many firewalls (looking at you fortinet) block http by default and only allow https through. So in addition to the why doesn't your site have security, you'd also get, why is your site down/blocked?

Re: Why HTTP without encryption and self-signed sertificates are OK

#33

Post by hotpotamus »

Sohcahtoa82 wrote: post #30

> There used to be a time when malicious websites usually didn't have encryption at all, or if they had, their certificate was self-signed. Let's Encrypt changed that. Now every malicious site has a certificate that appears trusted, and there will soon be a need of having different levels of "trust", where free-of-charge certificates like the ones from Let's Encrypt will become essentially untrusted. First off, this…

I thought the whole EV cert thing already came and more or less went.

https://en.wikipedia.org/wiki/Extended_Validation_Certificat...

Re: Why HTTP without encryption and self-signed sertificates are OK

#34

Post by hotpotamus »

JohnFen wrote: post #27
yalogin wrote: post #14

I don’t understand why the author claims self signed certificates are safe that users on the other end can verify for themselves that it’s the right party. Isn’t this exactly not possible for self signed certs? Anyone can mint a cert in my name, and that is the sole reason why CAs exist.

I don't use self-signed certs for this reason. Instead, I run my own CA to sign my certs. If you want to use my systems, and want to ensure the certs are correct, you need to get and install a root cert from me personally.

Well, you run one self-signed cert then.

Re: Why HTTP without encryption and self-signed sertificates are OK

#35

Post by JohnFen »

hotpotamus wrote: post #34
JohnFen wrote: post #27

Earlier quoted context omitted.

I don't use self-signed certs for this reason. Instead, I run my own CA to sign my certs. If you want to use my systems, and want to ensure the certs are correct, you need to get and install a root cert from me personally.

Well, you run one self-signed cert then.

True, but that's no different than any other root cert. It doesn't really count because it's not a cert that's directly used.

Re: Why HTTP without encryption and self-signed sertificates are OK

#36

Post by 10000truths »

nottorp wrote: post #15
gruturo wrote: post #12

Your ISP is - or soon will - be datamining the crap out of your browsing data, or injecting supercookies, or replacing NXDOMAIN queries taking you to their advertisement pages, or worse. Encrypting as much of your traffic (DNS included) is only sensible unless you wish more of your data to be mined and sold.

That's what privacy laws are for isn't it?

We don't need locks to protect our homes, that's what burglary laws are for.

Re: Why HTTP without encryption and self-signed sertificates are OK

#37

Post by UltraViolence »

nottorp wrote: post #15
gruturo wrote: post #12

Your ISP is - or soon will - be datamining the crap out of your browsing data, or injecting supercookies, or replacing NXDOMAIN queries taking you to their advertisement pages, or worse. Encrypting as much of your traffic (DNS included) is only sensible unless you wish more of your data to be mined and sold.

That's what privacy laws are for isn't it?

Like there aren't any in the U.S.

Re: Why HTTP without encryption and self-signed sertificates are OK

#38

Post by hotpotamus »

JohnFen wrote: post #35
hotpotamus wrote: post #34

Earlier quoted context omitted.

Well, you run one self-signed cert then.

True, but that's no different than any other root cert. It doesn't really count because it's not a cert that's directly used.

Yep, the root of trust has to start somewhere.

Re: Why HTTP without encryption and self-signed sertificates are OK

#39

Post by Raymonf »

> Showing the user nonsensical warnings like "Someone is trying to steal your credit card information!!!!11" only creates confusion and misconceptions about security.

So is this suggesting that browsers should automatically trust all certificates? The Kazakh government sure would like that to happen.

Re: Why HTTP without encryption and self-signed sertificates are OK

#40

Post by tialaramex »

ryan-c wrote: post #22
tialaramex wrote: post #9

Earlier quoted context omitted.

> The vast majority of users cannot do the "making sure" bit suggested here. Of those who can, the vast majority (including myself here) don't. Crucially, the browser is showing you historical information. This was the certificate for a transaction which already happened . Because this is about the past not the future you can't make decisions here, only have regrets. Whereas for certificate name verification and all…

I believe the flow allows you to view certificate information prior to accepting, and then only that certificate will be accepted for only that hostname.

Which browser do you think that's true for, and, have you tried it?
Post reply on HN