Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Still Why No HTTPS?

troyhunt.com

Post reply on HN
Print view View original

341–345 of 345 posts

Re: Still Why No HTTPS?

#341

Post by labawi »

xvector wrote: post #292
gmiller123456 wrote: post #279

1. The requirement to involve a 3rd party certificate authority is a needless power grab. Giving in ends the hope that it will ever get changed. 2. There is currently only one free cert provider, if there are ever issues with it, your users will see a scary error message which will make them think there are security issued with your website. 3. Downloading and running code from a 4th, or 5th party and giving it acces…

> The requirement to involve a 3rd party certificate authority is a needless power grab. Giving in ends the hope that it will ever get changed. Genuinely curious - what alternatives do you have in mind? Are there any WoT models that interest you more? > There is currently only one free cert provider, if there are ever issues with it, your users will see a scary error message Isn't this the point? > Downloading and ru…

>> There is currently only one free cert provider, if there are ever issues with it, your users will see a scary error message

> Isn't this the point?

The point is to secure the communication between client and server, and warn/stop it, if it is insecure (MITM et al.). It is counter-productive to stop the communication because an unrelated party (CA) is having issues.

Re: Still Why No HTTPS?

#342

Post by kuschku »

necovek wrote: post #339
kuschku wrote: post #333

Earlier quoted context omitted.

Because some websites serve something different on 443 and 80, and you won’t get the right result by visiting 443. The preload list allows you to specifically say that for your own website clients should always use HTTPS, which is a good solution, as it means no one is ever going to visit kuschku.de on port 80, except for curl and dev tools, for which the redirect is useful.

I disagree with the claim that it's better for a web site to implement HSTS than to fix whatever they are serving on 443. But to each their own.

It’s possible for me, today, to implement HSTS, and have my site served securely everywhere, today.

Browsers can’t set 443 as default, because other websites are broken, other websites I can’t fix and the browsers can’t fix either.

Re: Still Why No HTTPS?

#343

Post by necovek »

kuschku wrote: post #342
necovek wrote: post #339

Earlier quoted context omitted.

I disagree with the claim that it's better for a web site to implement HSTS than to fix whatever they are serving on 443. But to each their own.

It’s possible for me, today, to implement HSTS, and have my site served securely everywhere, today. Browsers can’t set 443 as default, because other websites are broken, other websites I can’t fix and the browsers can’t fix either.

We have differing views of "everywhere, today": you acknowledged yourself there are cases where it won't happen, it's just how much we think that's important where we differ. That's ok, I appreciate your point and thanks for spending the time to explain.

As for what browsers can or cannot do, they also can't introduce DNS-over-http, introduce stricter cookie policies breaking a bunch of web sites, or reduce effectiveness of ad-blockers, drop flash, or... Sure, defaulting to https is too high a bar (not expressing an opinion on any of those — eg. good riddance to Flash :) — but browsers can and have done stuff that's just as bad, forcing web site creators to adapt their web sites).

Re: Still Why No HTTPS?

#344

Post by xvector »

labawi wrote: post #341
xvector wrote: post #292

Earlier quoted context omitted.

> The requirement to involve a 3rd party certificate authority is a needless power grab. Giving in ends the hope that it will ever get changed. Genuinely curious - what alternatives do you have in mind? Are there any WoT models that interest you more? > There is currently only one free cert provider, if there are ever issues with it, your users will see a scary error message Isn't this the point? > Downloading and ru…

>> There is currently only one free cert provider, if there are ever issues with it, your users will see a scary error message > Isn't this the point? The point is to secure the communication between client and server, and warn/stop it, if it is insecure (MITM et al.). It is counter-productive to stop the communication because an unrelated party (CA) is having issues.

The CA is not an unrelated party. If the client cannot verify the validity of the cert against the CA, then it should throw up a warning message. If the server cannot get a cert signed by the CA, then it too should throw up a warning message, because it does not have the trust of clients by itself.

Re: Still Why No HTTPS?

#345

Post by zurn »

kuschku wrote: post #325
zurn wrote: post #318

Earlier quoted context omitted.

If you could get certificates for them, so could anyone else including your adversaries, since there is no system of ownership for them. It would be like issuing certs for https://192.168.1.1

Actually that's why browsers already treat http://127.0.0.1/ and certain other local IPs as if it was via https. For all local IP and domain space - that is 192.168/16, 10/8 and so on - it should automatically treat them as if they were safe anyway.

They're likely be part of a cafe/hotel/guest wlan or a poorly managed "intranet" full of vulnerable stuff that needs to be shielded from CSRF. That's in addition to having ambiguous addresses. So should definitely be treated as less safe.
Post reply on HN