Earlier quoted context omitted.
> Lets Encrypt certs are equivalent to self-signed certs. This is entirely false.
Oh yeah! sure... what exactly ensures that the DV cert is a DV cert?
[deleted]
Why isn't HTTPS everywhere yet?
51–60 of 130 posts
Re: Why isn't HTTPS everywhere yet?
#52Earlier quoted context omitted.
Of course the cross signed cert works! That not the point. The cross signature is worthless if the signed cert beneath it is self-signed. If Identrust cross signed self signed certs, the self signed cert would be trusted too... and it would "work" in all browsers... Coly Tarry Frap Tarts! you're daft. Here try this: 1. Setup a domain with an MX record that points off domain and a dmarc p=reject record... 2. Try to ge…
@pfg: I know exactly how CAs work. I've built several. Wosign does not issue a cert without an email verification. You can look on their website. There's a nice big box to enter an email address to verify your domain and get the free cert. Sorry -- "Let's Encrypt" with file verification is not DV. It's just not DV. Simple really... And it's gonna break the web. Like netlify up there a few post... using rackspace and…
I just signed up using my personal gmail address and was offered this option to verify domain ownership: http://puu.sh/mB373/62a963d896.png
The file contains a random token. This is essentially the same solution Let's Encrypt offers (among others).
Re: Why isn't HTTPS everywhere yet?
#53Three obvious reasons... Cost to the end user $10-200/year - even more on Heroku($20/month). Configuration/Setup sucks - seriously you are supposed to run a bunch of unix commands, copy something to a server, and the whole process isn't user friendly. Limited end user benefit - A business owner and user up until recently hasn't thought much or cared much about information security outside of online purchases. Until i…
"Cost to the end user $10-200/year"
What? How have you not heard of Let's Encrypt by now?
Re: Why isn't HTTPS everywhere yet?
#54Earlier quoted context omitted.
I'd imagine HTTPS is significantly more expensive to host than plain HTTP, due to the CPU requirements of the crypto involved.
Maybe at the CDN level where there's lots of caching it's different, but for regular hosting apps are primarily IO bound so it's essentially "free" to do encryption. From http://www.imperialviolet.org/2010/06/25/overclocking-ssl.ht... : > In January this year (2010), Gmail switched to using HTTPS for everything by default. Previously it had been introduced as an option, but now all of our users use HTTPS to secure th…
At the time that was written, only the frontends did TLS---remember, there wasn't universal strong encryption or authentication within Google's back-end until after the Snowden leaks.
Re: Why isn't HTTPS everywhere yet?
#55Earlier quoted context omitted.
Nope. The symmetric crypto is basically free. The asymmetric crypto is cheap. IPv4 addresses cost. Most big sites can't quite go SNI-only yet. Soon! Customer support costs. Why would TLS involve more customer support? Because it's a technology designed only to break connections. Ideally that's only the adversarial connections---but much like the TSA, a mis-designed authentication scheme can cause great stress and dra…
> IPv4 addresses cost. Most big sites can't quite go SNI-only yet. Soon! Why can't they go SNI? It's not like IE6 or netscape are relevant any more, is there some other issue?
Windows XP. Python through about 2.6. Java until quite recently. Old Perl code that I shudder to think about.
Oh, and some old Android. The Android version that started supporting SNI is apparently also the version that tightened up licensing, so a number of third-world forks still use the old version. And as long as most of the web works without SNI, they don't have a huge incentive to change that.
The work that some browser vendors (Mozilla, Google) are doing to privilege imperfect-TLS over no-TLS is crucial here. Also, yes: new Web work should all be done over HTTPS.
Re: Why isn't HTTPS everywhere yet?
#56I'm not convinced it's even a great idea until something is done about a) the entirely broken CA trust model or b) mainstream web browser's entirely broken attitude to that trust model.
Re: Why isn't HTTPS everywhere yet?
#57Earlier quoted context omitted.
Of course the cross signed cert works! That not the point. The cross signature is worthless if the signed cert beneath it is self-signed. If Identrust cross signed self signed certs, the self signed cert would be trusted too... and it would "work" in all browsers... Coly Tarry Frap Tarts! you're daft. Here try this: 1. Setup a domain with an MX record that points off domain and a dmarc p=reject record... 2. Try to ge…
@pfg: I know exactly how CAs work. I've built several. Wosign does not issue a cert without an email verification. You can look on their website. There's a nice big box to enter an email address to verify your domain and get the free cert. Sorry -- "Let's Encrypt" with file verification is not DV. It's just not DV. Simple really... And it's gonna break the web. Like netlify up there a few post... using rackspace and…
I regularly purchase SSL certificates - about 10 or so a year, from gandi. Their validation process is identical to lets encrypt without the automation. All someone needs to get a cert is to control http://yourdomain.tld/ file> for the brief verification period. A DV cert is automatically issued without an email confirmation of any sort to the domain. I'm certain because I've set up SSL for domains that have no MX records nor any mail servers at the apex record. http://wiki.gandi.net/en/ssl/dcv
DV certs make no promises about the identity of the site operator, just that communications are encrypted. I remember a decade ago buying certificates from Thawte required faxing them business records and ensuring that the D&B records matched the domain registration - while paying $450/year for a cert for a single hostname. The process was through, but wholly unnecessary for the vast majority of sites that weren't directly taking payment information.
Re: Why isn't HTTPS everywhere yet?
#58Still no mention about ads. Using HTTPS means you have to load ads over HTTPS and a huge number of ad networks are not reachable over HTTPS and another large number of assets / tags are hard coded to fetch HTTP resources. For any ad supported website, HTTPS will cause a significant loss of ad revenue. Given how long it's taking the industry to transition away from Flash I'm not holding my breath about this being fixe…
I'm surprised by this. Both Google and Amazon forced the adtech provider I work for to move to HTTPS and fix all the associated errors mid last year.
Re: Why isn't HTTPS everywhere yet?
#59When I lived in China I was pretty happy the https movement hadn't won yet. Sites that forced me on a secure line were basically useless.
The great firewall doesn't appreciate encrypted connections, and will usually grind to a halt, when deciding if it will let you get the content.
Re: Why isn't HTTPS everywhere yet?
#60"Why isn't HTTPS everywhere yet?": Because it makes absolutely no sense for the vast majority of online content. Email in https ? Sure. Reading news sites in https ? Accessing RFC in https ? My favorite online recipe site in https ? A total waste of money and CPU.
Oh, and sure, the problem has been "solved" for few geeks using the latest browsers accepting let's encrypt certificates. Sure.