So is there a lets encrypt solution for shared-hosting systems?
Google Will Soon Shame All Websites That Are Unencrypted
41–50 of 369 posts
Re: Google Will Soon Shame All Websites That Are Unencrypted
#42I think it's pretty funny that on the HN front page right now is a NYTimes article from the company's Google beat reporter about how trying to interview Larry Page is "emasculating" and then this announcement is accompanied by an image "shaming" the NYTimes web site for being unencrypted. As to the feature itself, I don't think it's a big deal at all. We all know that the average internet denizen doesn't understand H…
I work for a SaaS company, we absolutely have customers who email us complaining about putting credit cards in a page served over http.
Re: Google Will Soon Shame All Websites That Are Unencrypted
#43All of this raises the question: why does the new default state require action, while the non-default state requires none?
Is that more or less bass-ackwards?
Re: Google Will Soon Shame All Websites That Are Unencrypted
#44Yeah. Still not paying for a cert on my person home-pages just so I can have my own page come up first when people google my (worldwide unique) name. That page contains static HTML and does not need SSL, and it's not "insecure" just because you may be on a network which MITMs traffic. That makes your network insecure, not my page. So yeah. Not interesting. Not worth it.
I've just wired you the amount needed to buy an SSL certificate from any of multiple reputable and well-priced providers. You can use the money I sent you to buy a cert from https://letsencrypt.org/ , https://www.startssl.com/Support?v=1 , or https://www.cloudflare.com/plans/ .
If those options aren't enough for you, let me know why and also how to non-vacuously send you money, and I'm happy to buy you a $4.99/year certificate from https://www.ssls.com/ssl-certificates/comodo-positivessl .
Re: Google Will Soon Shame All Websites That Are Unencrypted
#45Google should offer stupid SSL certificates either for free or for $1/yr. Perhaps at least to customers of Google domains. I won't mind switching from namecheap to Google domain in latter case.
They are a platinum sponsor of Letsencrypt, so...done?
Re: Google Will Soon Shame All Websites That Are Unencrypted
#46Several weeks ago I have installed certificate to my web site on NGINX and it wasn't hard. It was fun to do. Also I got A+ from Qualys SSL Labs. What I mean is it is easy to deploy an HTTPS site.
Re: Google Will Soon Shame All Websites That Are Unencrypted
#47So what about the overhead of https?
For the last few years, effectively zero.
https://www.maxcdn.com/blog/ssl-performance-myth/
https://www.imperialviolet.org/2010/06/25/overclocking-ssl.h...
Not to mention that if you use CloudFlare just to get a free SSL certificate out of them, you're also getting a CDN, so the performance overhead is negative.
Re: Google Will Soon Shame All Websites That Are Unencrypted
#48I think 80% of web sites will be labelled as red-unsafe. SSL layer security is good but sometimes a certificate is expensive and not free. Suppose that you have 10 domains and not all of them are for SNS, banks and etc.. At what minimum cost will you purchase a HTTPS certificate?
nada. http://letsencrypt.org/
Most shared hosting accounts charge extra for a dedicated IP address, both for setup and on a monthly basis. Don't underestimate how many blogs, churches, small businesses, etc still use services like that.
To be fair, many of those sites probably ARE insecure, but it seems to be a little bit overkill to "shame" them for not implementing encryption.
Re: Google Will Soon Shame All Websites That Are Unencrypted
#49Sounds good. I wonder when Google Cloud Storage will start supporting https on static websites hosted through them: https://cloud.google.com/storage/docs/website-configuration?... If they don't then they're not keeping up with hosting on Amazon's S3, which does support it.
Similar (very, since appengine static files are served from GCS), is to write a "python" appengine yaml file that only serves the static content with secure: always.
Re: Google Will Soon Shame All Websites That Are Unencrypted
#50Earlier quoted context omitted.
Because you need to create a public key for the browser to use.
SSH gets this right -- create a host key when the server is installed, and have the client check the key and only warn/error when it changes. Sure, this isn't super-secure for first time visitors to their banking website or whatever, but those websites can continue to use the current system.
SSH doesn't get this right. It's no better than a (auto-pinned) self-signed cert, in our world.
I challenge everyone to find in their extended group of friends and colleagues, and their friends and colleagues, a single person who consistently checks the fingerprint* on every first SSH connection.
Id personally have a hard time finding someone who even knows it matters.
And if you don't? Mitm can get your password, or tunnel your key to another host, bar some crazy ~/.ssh/config which nobody has.
WiFi's WPA2 actually does this better than SSH; the passphrase authenticates both parties to eachother, not just one way. I can't set up a hotspot with your home SSID and intercept your PSK---even on initial connection.
SSH: nice in a cryptographic utopia, not better than self signed SSL certs when applied to human beings.
SSH is just not suitable for humans. Apparently.
* a significant part of it, not just the security-through-obscurity random 2 letters in the middle and the last four.