Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Will Soon Shame All Websites That Are Unencrypted

motherboard.vice.com

Post reply on HN
Print view View original

351–360 of 369 posts

Re: Google Will Soon Shame All Websites That Are Unencrypted

#351

Post by airswimmer »

unicornporn wrote: post #113
bcg1 wrote: post #48

Earlier quoted context omitted.

Most shared hosting accounts charge extra for a dedicated IP address, both for setup and on a monthly basis. Don't underestimate how many blogs, churches, small businesses, etc still use services like that. To be fair, many of those sites probably ARE insecure, but it seems to be a little bit overkill to "shame" them for not implementing encryption.

I have shared hosting at Dreamhost. Installing Let's Encrypt certs was a two click procedure. I guess more hosting companies will follow.

This looks cool. It seems dreamhost did a good job.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#352

Post by JoshTriplett »

airswimmer wrote: post #347
JoshTriplett wrote: post #218

Earlier quoted context omitted.

Nothing short of that will get HTTPS adoption to approach 100%. Many people have commented that it seems odd to complain about broken HTTPS but not about HTTP; I agree with that. As long as browsers show unencrypted HTTP as "neutral" rather than "bad", far too many sites simply won't care. This has been a long and gradual step, but it needs to happen for HTTP to finally go away.

HTTPS is rather more secure than what HTTP is. Because it creates a relative secure tunnel between the client and host. But HTTPS does not mean 100% secure, it's easy to be hacked by MITM or traffic been spied. I think that getting rid of HTTP should not be shamed in that way. But google is planning on doing this thing. Just as someone said, MITM attackers can switch google ads to others, and I think this is the reas…

> But HTTPS does not mean 100% secure, it's easy to be hacked by MITM or traffic been spied.

I don't know what properties you think HTTPS lacks here, but no, HTTPS doesn't allow "easy" MITM or eavesdropping. If you want to break HTTPS, you either need to compromise an endpoint, or pressure an accepted certificate authority to risk destroying their entire business by issuing a fraudulent certificate.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#353

Post by st3v3r »

Dylan16807 wrote: post #249
tyingq wrote: post #111

Earlier quoted context omitted.

This is also effectively true for the more broadly used Google Adsense (not just DFP). They do support displaying adsense, but then screen out all non-https ads. Which, of course, results in a lower CPM.[1] [1] https://support.google.com/adsense/answer/10528?hl=en >>In short; Google will penalize me because I use Google +++

To be fair, sites without ads are a better experience than sites with ads.

I dunno. Sites that can't pay the bills tend not to give good experiences, due to not being able to do things. Like exist.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#354

Post by kamaln7 »

bad_user wrote: post #325
notatoad wrote: post #107

Earlier quoted context omitted.

No, it does not. Signing up for google apps and choosing to use the google apps account as your primary google user account causes you to get new features on a delayed schedule. You can get a domain through google without switching your google identity to it. You can also sign up for google apps on a non-google domain. google domains and google apps are not the same thing.

On Google Apps there are features that have been deployed years ago for regular accounts and that are still not available for Google Apps customers. The one feature missing and that was painful for me were Contacts photos with a resolution higher than 96x96 pixels. On a latest generation Android with good resolution it sucks and I would have preferred if Contacts photos weren't synchronized at all. I ended up switchi…

Hold on. Are you saying that that's why Android's Contacts keeps resizing all the photos to like 4x4px? Wow, I've tried everything I could find on Google but it never crossed my mind that it would be related to Google Apps. Thanks so much!

Re: Google Will Soon Shame All Websites That Are Unencrypted

#355

Post by Dylan16807 »

st3v3r wrote: post #353
Dylan16807 wrote: post #249

Earlier quoted context omitted.

To be fair, sites without ads are a better experience than sites with ads.

I dunno. Sites that can't pay the bills tend not to give good experiences, due to not being able to do things. Like exist.

Depends on what the bills are for. Most sites that don't have content-production staff need twenty bucks a month for hosting, plus an occasional prod from a sysadmin.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#356

Post by tyingq »

Dylan16807 wrote: post #355
st3v3r wrote: post #353

Earlier quoted context omitted.

I dunno. Sites that can't pay the bills tend not to give good experiences, due to not being able to do things. Like exist.

Depends on what the bills are for. Most sites that don't have content-production staff need twenty bucks a month for hosting, plus an occasional prod from a sysadmin.

Are there some types of content where the author, photographer, etc will produce it without direct compensation? Sure.

Are there others where that's not practical? Also, yes. Maybe not things that you need, but this problem does exist.

At the moment, there's not a model, outside of ads, that works very well for that sort of thing. There are some subscription/micropayment schemes that seem promising, but nothing that works as well as ads do.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#357

Post by Dylan16807 »

tyingq wrote: post #356
Dylan16807 wrote: post #355

Earlier quoted context omitted.

Depends on what the bills are for. Most sites that don't have content-production staff need twenty bucks a month for hosting, plus an occasional prod from a sysadmin.

Are there some types of content where the author, photographer, etc will produce it without direct compensation? Sure. Are there others where that's not practical? Also, yes. Maybe not things that you need, but this problem does exist. At the moment, there's not a model, outside of ads, that works very well for that sort of thing. There are some subscription/micropayment schemes that seem promising, but nothing that…

I didn't say it was supposed to work for all sites, just that st3v3r is ignoring a huge swath of the internet by implying that nonprofessional sites don't exist.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#358

Post by [deleted] »

pluma wrote: post #316
schoen wrote: post #286

Earlier quoted context omitted.

Apparently Iraq, Iran, Yemen, the Congo, Lebanon, and Chad are masculine in German: https://german.yabla.com/lessons.php?lesson_id=409

Actually I can't think of many cases where German would use pronouns with countries. The reason these are masculine is because they are typically referred to using a definitive pronoun (literally "the Iraq", "the Iran", etc). It's more common with names of regions -- which may indicate that these countries used to be mere geographical regions (rather than sovereign nations) when the names entered the German language.…

[deleted]

Re: Google Will Soon Shame All Websites That Are Unencrypted

#359

Post by clinta »

yoz-y wrote: post #313
geofft wrote: post #32

Earlier quoted context omitted.

Isn't that what Let's Encrypt is aiming for? Install a package, which configures a cronjob for you? https://letsencrypt.org/howitworks/ Which could just even become a default but optional dependency of your distro's web server package, or part of your Docker container, or whatever.

Let's Encrypt is awesome but you still need to have root access to the machine. I host my stuff on a shared 1&1 node and I can't seem to find any way to add SSL to my websites without having to pay them. (Yes I should move to another host but that is too much hassle for me right now.)

The ACME protocol is open and as a result there are several alternative clients which do not require root. Here's a few:

https://github.com/diafygi/letsencrypt-nosudo

https://github.com/kuba/simp_le

https://github.com/lukas2511/letsencrypt.sh

Or you can go a more manual approach via https://gethttpsforfree.com/ but you will need to manually renew your certificate every 90 days.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#360

Post by clinta »

cellularmitosis wrote: post #163
schoen wrote: post #154

Earlier quoted context omitted.

If you don't have a way to confirm that the key you're seeing from the other site is right, you're inherently vulnerable to a man-in-the-middle attack which removes the benefits of the encryption against the attacker. https://en.wikipedia.org/wiki/Man-in-the-middle_attack httpS://en.wikipedia.org/wiki/Zooko's_triangle It's not clear that the certificate authority system was or is the best solution to this problem, bu…

However, having one and not the other isn't totally useless. Having the browser be able to track and tell me that "Though we aren't sure this is actually google.com, we do know that the exact same cert has been used the last 50 times you visited this website" is something I'd consider to be useful. (Actually, telling me if it changes would be the useful bit). That would be at least be useful for self-signed certs (th…

Take a look at google's certs. They're only valid for a few months. A system that tracks certificates encourages site operators to share the same cert and key across many servers and to allow it to live for a long time. With the sorry state of certificate revocation this is not ideal.

On the server side it's better for each server to have it's own private key and certificate which is valid for a short period of time and frequently renewed. So the compromise of one server does not compromise certificates on any other servers and the useful lifetime of a compromised key is very limited.

I think DNSSEC and DANE is the best solution. Allow the certificate thumbprints to be published securely in DNS. At least then we reduce the number of trusted authorities to the TLDs and the scope of authority for each one is automatically restricted to it's own TLD.

Post reply on HN