Live data from Hacker News

It’s Time to Encrypt the Entire Internet

wired.com

41–50 of 99 posts

Re: It’s Time to Encrypt the Entire Internet

#41

The only problem I see with https everywhere is the current CA system. I don't trust CAs, and I don't want to pay them. If we can get rid of them somehow there is nothing in the way of https everywhere anymore. I really like the http://convergence.io/ approach, but anything else that gets rid of a central authority I have to trust will do for me.

I'm wondering how well this scales. If you have thousands of upon thousands of people/companies that you trust, how do you ensure that they all remain trusted? What happens if you need to go through all of the certificates to ensure they can still be trusted?

Re: It’s Time to Encrypt the Entire Internet

#42
post #37
post #25

Earlier quoted context omitted.

> It's time to decentralize the internet. There is no good reason why we can't have email, webpages, photos, even facebook-like social stuff housed on our own machines in our own homes (or some other place under our control). I think there is a good reason. Who wants to spend the time setting up and running a server? I happen to run my own, but it is definitely not something I would recommend to my friends and family…

> Maybe someone will come along and create a super easy to install and low maintenance server platform. There is a developer release available already: https://freedomboxfoundation.org/ All packages are included in Debian Sid.

My mom can't install that herself, and wouldn't be able to find information on how to do it by browsing the freedombox website.

It's so obvious that the current freedombox website is targeted at computer geeks only and not general people. It is not 'super easy to install' if it's not granny-proved.

Re: It’s Time to Encrypt the Entire Internet

#43
post #10

It's time to decentralize the internet. There is no good reason why we can't have email, webpages, photos, even facebook-like social stuff housed on our own machines in our own homes (or some other place under our control). The current situation is akin to having to travel to some centralized letter-reading facility in order to read letter mail. Your grandma sends you a letter in the mail and you have to go to a cent…

I think it's time to stop cooking up technology solutions to political problems. It's a lazy hack and a distraction.

The counter-parties that encryption will supposedly neutralize are commercial entities doing monitoring for advertising (or other purposes) and government surveillance. Commercial entities have all sorts of ways to collect said information (ie. by compelling you to opt-in in exchange for services). The government has a long history of successfully breaching encryption when it's motivated to do so.

The solution is to leash these powerful entities with regulation. Elect Senators with the courage to curb the intelligence community -- it was done before after the excesses of the Vietnam Era.

Re: It’s Time to Encrypt the Entire Internet

#44
post #26

Earlier quoted context omitted.

> It's time to decentralize the internet. There is no good reason why we can't have email, webpages, photos, even facebook-like social stuff housed on our own machines in our own homes (or some other place under our control). This is how the internet is designed, and you can already do this today. In my case, I host my own dns, email, and my own webpages, locally on my home connection. You just have to be willing to…

Why would you need your own DNS?

Most people don't need it, but there are reasons it can be convenient. And some just like to do everything in-house either as a learning exercise or for control freakery reasons.

Control of TTL values is on example. Most registrars use 4 hours these days but it used to be that 24 hours was the value used by most (with not option of anything else). That can be a minor convenience if you expect to move things around much. I have all mine set to 5 minutes (not a great idea for anything high traffic, but nothing of mine is). If you know what you are doing running a small DNS service is no great hardship at all (though it is surprising how many people don't get it right). Custom dDNS is another reason you might want this (though I think some registrars and specialist DNS hosts offer this for little or no cost these days).

In my case it costs nothing as the three bind instances I run live on geographically separate machines that I already have for other reasons (home line, external web service, backup location) - if you have no external resources already then you'd need to pay for somewhere to host a secondary server of course (cheap, reliable enough, and fast enough VPS services are common so that needn't be much cost - though a specialist DNS services needn't any more expensive these days either and will likely be more scalable than anything we setup manually).

Re: It’s Time to Encrypt the Entire Internet

#45
post #10

It's time to decentralize the internet. There is no good reason why we can't have email, webpages, photos, even facebook-like social stuff housed on our own machines in our own homes (or some other place under our control). The current situation is akin to having to travel to some centralized letter-reading facility in order to read letter mail. Your grandma sends you a letter in the mail and you have to go to a cent…

> housed on our own machines in our own homes

I for one do not want to be lumbered with maintaining my family's collection of micro services, making sure they are working OK, not compromised, and fully patched security-wise, and so forth. Its bad enough being expected to disinfect their laptops every other time the fail to follow my advice on being careful what they browse.

Re: It’s Time to Encrypt the Entire Internet

#48
post #36

Earlier quoted context omitted.

So I'm looking at moving my VPS into a box at home, but I have an IP that changes every so often. What's the best way to fix that? I've got no problems with DNS being hosted on Route53 or something else.

Just use one of the multitude of dynamic dns providers.

Yep. They give you a little program that runs on your computer that checks your external IP address at frequent intervals and updates the DNS records when it changes. Better yet, some home routers have a configuration page where you can select among popular Dynamic DNS providers and then you don't need to run the proprietary program. My ISP-provided router (FiOS) has ZoneEdit in the list which I've used for years even before I had FiOS, so it was a nice surprise when I found it there. Just for sake of example here's a link: http://www.zoneedit.com/dynamicDNS.html

Re: It’s Time to Encrypt the Entire Internet

#49
post #9

Earlier quoted context omitted.

Wired just got it wrong postfixing https instead of prefix :) http://www.wired.com/2014/04/https/ But to stay on topic: encouraging this kind of major shift to SSL spreads a problem that is still there but is very little acknowledged or worked on -- revocations. Certificate revocation check is using either CRL or OCSP. CRL is a list of all the revoked certificates - browser needs to download the whole file and then c…

However, it seems possible to explicitly use a secure browser (i.e. one that checks certificate revocations) if the need arises. You don’t need 99% browser-market coverage to allow people to securely connect to your site, nor do you need 99% browser-market coverage to securely connect to a given site. You only need that site to implement HTTPS, either with a self-signed cert and e.g. Certificate Patrol on your side o…

This all sounds good but at the same time only Firefox has OCSP Hard Fail feature (OCSP failure==invalid cert). Please correct me if it's still possible with others.

Also user must become a rather paranoid person in order to start using a browser in mobile that supports hard fail OCSP. Getting HTTPS everywhere shouldn't mean promoting false sense of security.

Considering that most HTTPS attacks require MITM it seems to me that OCSP without Hard Fail leaves attack vector wide open.

Re: It’s Time to Encrypt the Entire Internet

#50
post #30

Earlier quoted context omitted.

"Maybe someone will come along and create a super easy to install and low maintenance server platform" that's the idea

How would you ensure operational continuity for my mom who only has an ipad? Since that's the direction the world seems to be taking.

Server/router hybrids.
Post reply on HN