31–40 of 44 posts
Uh. What if a site doesn't need https? Like if it has just static pages with public content?
I wrote about this a few months ago: https://rythie.com/blog/blog/2014/03/05/should-all-sites-use...
Earlier quoted context omitted.
You are? ETA?
That's detailed in the blog post I was linking to above: http://blog.cloudflare.com/google-now-factoring-https-suppor... To quote it: "Second, at CloudFlare we've cleared one of the last major technical hurdle before making SSL available for every one of our customers -- even free customers. We're on track to roll out SSL for all CloudFlare customers by mid-October."
Related: https://news.ycombinator.com/item?id=8146660
> We're on track to roll out SSL for all CloudFlare customers by mid-October. When we do, the number of sites that support HTTPS on the Internet will more than double To be secure, won't this require your customers to set up HTTPS between CloudFlare and their hosting providers, which will require additional manual setup with their hosting provider, assuming they even support HTTPS? It seems rather optimistic to assum…
Wouldn't want the next big community to be fake-secure to save a few quid
Source: https://support.cloudflare.com/hc/en-us/articles/200170416-W...
"The decision could encourage more sites to turn on encryption, which makes them less vulnerable to hacking". What? This is entirely wrong. It makes them more vulnerable to hacking. There is a whole lot more complex software and configuration to get right, and we know SSL doesn't have a great recent history of that.... Of course it help secure the communications which presumably is what they meant but it's 100% wrong…
It makes YOU (the consumer) less vulnerable to "hacking" (MiTM), it actually doesn't make the website less vulnerable and as you quite correctly pointed out somewhat more (just due to increased attack surface).
That's a large part of the reason HTTPS/SSL isn't more common: It doesn't benefit the website as much as it benefits their customers and there are both real and perceived costs in deploying HTTPS.
So you have to put pressure on them (websites) to adopt secure defaults. Google are now helping hugely.
Good. Also, I recently poked the bear on the chromium and mozilla dev security mailing lists, and they started discussing ways to push https in the browser UI. Hopefully this momentum continues! https://groups.google.com/a/chromium.org/forum/m/#!topic/sec...
Checkout how FF renders a standard domain validated cert on a site versus one with extended green bar validation:
https://www.expeditedssl.com/assets/browser-ssl/thumbs/stand...
https://www.expeditedssl.com/assets/browser-ssl/thumbs/exten...
The gray icon might as well not be there as far as consumers are concerned and blue vs green crossing guard icons really fail to indicate anything of use to an end user.
If you want to see a big list of SSL UI screenshots, I have them up at:
https://www.expeditedssl.com/pages/visual-security-browser-s...
Uh. What if a site doesn't need https? Like if it has just static pages with public content?
Even for wikipedia there are privacy implications of third parties knowing which page you are visiting and integrity concerns in places countries that want censor certain topics (e.g. China). I wrote about this a few months ago: https://rythie.com/blog/blog/2014/03/05/should-all-sites-use...
It is technically encrypted in HTTPS traffic but it isn't treated with very much respect so if you actually have access to all of the HTTP and DNS traffic surrounding a request you can often recover pages viewed.
Additionally, in a lot of these countries computers come pre-installed with a government root CA which they can use to impersonate sites like Wikipedia (although the USG does this too!).
Uh. What if a site doesn't need https? Like if it has just static pages with public content?
Even for wikipedia there are privacy implications of third parties knowing which page you are visiting and integrity concerns in places countries that want censor certain topics (e.g. China). I wrote about this a few months ago: https://rythie.com/blog/blog/2014/03/05/should-all-sites-use...
Good. Also, I recently poked the bear on the chromium and mozilla dev security mailing lists, and they started discussing ways to push https in the browser UI. Hopefully this momentum continues! https://groups.google.com/a/chromium.org/forum/m/#!topic/sec...
What happens if this influence turns completely and more directly self-serving? Such as, Google adwords customers are given higher organic ranking, weighted by how much they spend?
At first glance it might appear that such a scheme would work against adwords, but it really wouldn't because the ad-click advertising just doesn't work for a lot of us, but organic search does.
Absolute power corrupts absolutely, and all that.
Earlier quoted context omitted.
Even for wikipedia there are privacy implications of third parties knowing which page you are visiting and integrity concerns in places countries that want censor certain topics (e.g. China). I wrote about this a few months ago: https://rythie.com/blog/blog/2014/03/05/should-all-sites-use...
That's a nice concept, but even with HTTPS the GET string is often leaked (e.g. referrer strings, tracking URLs (like Google's prior to this)). It is technically encrypted in HTTPS traffic but it isn't treated with very much respect so if you actually have access to all of the HTTP and DNS traffic surrounding a request you can often recover pages viewed. Additionally, in a lot of these countries computers come pre-in…
"A user agent MUST NOT send a Referer header field in an unsecured HTTP request if the referring page was received with a secure protocol." http://tools.ietf.org/html/rfc7231#section-5.5.2
and that's how browsers implement it too.
DNS doesn't give the page you were on. Whilst some systems might have a government root CA on it, it's still quite possible to remove that - it's pratically impossible to remove ISP level monitoring.
Earlier quoted context omitted.
Even for wikipedia there are privacy implications of third parties knowing which page you are visiting and integrity concerns in places countries that want censor certain topics (e.g. China). I wrote about this a few months ago: https://rythie.com/blog/blog/2014/03/05/should-all-sites-use...
HTTPS doesn't hide which page you're visiting, does it?
