Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Https hurts users far away from the server

antoine.finkelstein.fr

Post reply on HN
Print view View original

41–50 of 128 posts

Re: Https hurts users far away from the server

#41

Post by rplst8 »

spand wrote: post #32
cmdrfred wrote: post #18

Earlier quoted context omitted.

May I add an example. Let's say you are a drug company and you offer a number of different drugs. With TLS I only know that you are interested in a drug that company produces or the company itself, without it I know you or someone you care about has erectile dysfunction.

No that is not all an attacker could know. TLS does not provide confidentiality of the number of bytes transmitted. So in your example an attacker would only have to crawl the public website and find the pages matching in size to the ones you have been browsing.

Couldn't this be thwarted by injecting random bytes into each page served to vary the file sizes?

Re: Https hurts users far away from the server

#42

Post by mi100hael »

spand wrote: post #32
cmdrfred wrote: post #18

Earlier quoted context omitted.

May I add an example. Let's say you are a drug company and you offer a number of different drugs. With TLS I only know that you are interested in a drug that company produces or the company itself, without it I know you or someone you care about has erectile dysfunction.

No that is not all an attacker could know. TLS does not provide confidentiality of the number of bytes transmitted. So in your example an attacker would only have to crawl the public website and find the pages matching in size to the ones you have been browsing.

There are web server modules that will append random-length comments to the end of a page's HTML in order to foil this kind of attack

https://github.com/nulab/nginx-length-hiding-filter-module

Re: Https hurts users far away from the server

#43

Post by deallocator »

mrkurt wrote: post #30
Kiro wrote: post #4

I don't understand why I need to use https on a static marketing webpage. No login stuff, no JavaScript, nothing. Just straight up HTML and CSS. Right now I need to pay about $150 every year for something that's only used to satisfy Google PageRank (I can't use LetsEncrypt with my hosting provider). Why?

Most of the answers you're getting aren't all that big of deal for your site. You still might want https though. You should think about https for sites like yours the way you think about vaccines. SSL everywhere makes everyone safer, even though it doesn't have a tremendous impact on your own site. Also, shameless plug, if you want really easy SSL you can use our new startup: https://fly.io . I'm not sure what countr…

But of nitpicking, but on mobile the balloon is cut off a bit at the top :)

Re: Https hurts users far away from the server

#44

Post by jacquesm »

The biggest impact you can have on your users experience is to trim down the number of connections and the size of your pages. Long after that you can start worrying about round-trip-times to the server.

This blog post is a nice example: 30 requests (ublock origin blocked another 12, with those enabled the time to load increases to a whopping 28 seconds), 2.5M transferred, 7 seconds load time. And all that for 4K payload + some images.

Re: Https hurts users far away from the server

#45

Post by hedora »

Presumably, cloudflare is up to its ears in NSL's, illegal wiretaps, etc. If you care at all about mass surveillance, censorship, oppressive governments (in the US, or the location of the cloudflare proxy) you probably should look elsewhere.

It's probably controversial, but I'd love to see a yellow security icon in browsers when sites are using well known https relays that can see plaintext (or are doing other obviously bad things, like running software with known zero day exploits, etc)

Re: Https hurts users far away from the server

#46

Post by djsumdog »

Nullabillity wrote: post #6
Kiro wrote: post #4

I don't understand why I need to use https on a static marketing webpage. No login stuff, no JavaScript, nothing. Just straight up HTML and CSS. Right now I need to pay about $150 every year for something that's only used to satisfy Google PageRank (I can't use LetsEncrypt with my hosting provider). Why?

Yeah, why are you using a bad hosting provider?

When I was in the EU, I saw both Vodaphone and Three inject banners on the top of websites in various countries.

They're not as easy to get away from as you think.

Re: Https hurts users far away from the server

#47

Post by jacquesm »

hedora wrote: post #45

Presumably, cloudflare is up to its ears in NSL's, illegal wiretaps, etc. If you care at all about mass surveillance, censorship, oppressive governments (in the US, or the location of the cloudflare proxy) you probably should look elsewhere. It's probably controversial, but I'd love to see a yellow security icon in browsers when sites are using well known https relays that can see plaintext (or are doing other obviou…

A mini audit along the lines of 'builtwith'.

Hm. Good idea, why not go a step further and turn the 'no server signatures' advice on it's head: full disclosure, server signatures on, in fact, list each and every component in the stack so that end users can (through some plug-in) determine whether or not a site is safe to use.

Of course nothing bad could ever come from that. /s

I'm all for making the use of for instance Cloudflare less transparent so that users know who they are really talking to, but I'm confused about how you'd want to establish what a site is running without giving a potential attacker a lot of valuable information.

Re: Https hurts users far away from the server

#48

Post by jacquesm »

KabuseCha wrote: post #27
alvil wrote: post #3

There is also another problem on how much and how often is Googlebot indexing your site because your site speed is one of the factors of so called Google index budget. My users are in Germany so my VPS is also in Germany to be fast for local user (~130ms for http reply), but for US Googlebot is my site slow (~420ms for http reply). So you are penalized also for this.

Hi - I know some tools report a slow site in this case, but these reports are not accurate - don't believe them! Google is not that stupid ! :D I am currently working as a dev in an SEO-Agency (in Austria), and we never believed this hypothesis - so we tested this once with a bunch of our sites: When moving sites with a German speaking audience to a VPS in America, your rankings at google.de/google.at will decrease (…

The whole idea that search engines should take preference over actual users is strange.

Re: Https hurts users far away from the server

#49

Post by c0nfused »

It seems to me that it is worth considering that HTTPS is not always a panacea of goodness. We should think about two things.

First that almost every firewall out there right now supports https snooping via MITM. Example: https://www.paloaltonetworks.com/features/decryption

Second, I just got back from rural China where most unblocked american webpages take between 5-15 seconds to load on my mobile phone many of them take upwards of a minute to load fully. This seems to be a fun combo of network latency, smaller than expected bandwidth, and pages using javascript with a series of different load events to display content. That dompageloaded->xmlhttprequest -> onreadystatechanged chain can ad some serious time on a 500ms round trip, and that's without talking about the css, the images, and the javascript.

I forgot to pay me electric bill before I flew out and it took me nearly an hour to login, push pay my bill, accept the terms, and confirm payment. I was not a happy camper.

It seems to me that while https is a very good thing, in some cases http and low bandwidth solutions might be worth implementing. It seems to me that one might actually want to tailor this to your audience, no one in their right mind is going to waste 5 minutes loading your web page. If they are so desperate they need to wait, they are going to hate you every minute they do it.

Re: Https hurts users far away from the server

#50

Post by jacquesm »

c0nfused wrote: post #49

It seems to me that it is worth considering that HTTPS is not always a panacea of goodness. We should think about two things. First that almost every firewall out there right now supports https snooping via MITM. Example: https://www.paloaltonetworks.com/features/decryption Second, I just got back from rural China where most unblocked american webpages take between 5-15 seconds to load on my mobile phone many of them…

> This seems to be a fun combo of network latency, smaller than expected bandwidth, and pages using javascript with a series of different load events to display content.

You forgot about the great firewall of China playing merry MITM with your connections.

Post reply on HN