Google Will Soon Shame All Websites That Are Unencrypted • Hacker News Board

Re: Google Will Soon Shame All Websites That Are Unencrypted

#51

Post by freehunter » Wed, Jan 27, 2016, 9:30 PM UTC

conanbatt wrote: post #36

drawkbox wrote: post #34

Hopefully costs for certificates will come down to encourage it as well. Services like letsencrypt can help.

Supply and demand would dictate otherwise

Well it's not like certs are a limited quantity; they take no time to produce, no limited resources to produce, and no manpower to produce. Supply and demand works when demand outstrips supply, so the price goes up to put downward pressure on the demand. There's no possible way for demand to outstrip supply of certificates, so prices shouldn't go up.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#52

Post by pfg » Wed, Jan 27, 2016, 9:32 PM UTC

pjc50 wrote: post #41

So is there a lets encrypt solution for shared-hosting systems?

The solution for shared hosting environments is for your provider to integrate with Let's Encrypt (or any other free CA that might pop up in the future).

Once this change goes through, providers will be forced to either do that or (if they think forcing users to keep paying for SSL, even though it's de-facto mandatory) watch their customers move somewhere else. There's plenty of competition out there, and a lot of them already support Let's Encrypt[1].

[1]: https://github.com/letsencrypt/letsencrypt/wiki/Web-Hosting-...

Re: Google Will Soon Shame All Websites That Are Unencrypted

#53

Post by mikecb » Wed, Jan 27, 2016, 9:32 PM UTC

oliv__ wrote: post #23

Why do we have to go through this whole SSL certificates thing and can't just have a simple, automatically secure, I-do-nothing-and-my-website-is-secure protocol? Seriously though. If secure is the default from now on, why can't it actually be the default?

If apache and nginx follow along the lines of Caddy[1], we might.

[1] https://caddyserver.com/

Re: Google Will Soon Shame All Websites That Are Unencrypted

#54

Post by bobfunk » Wed, Jan 27, 2016, 9:32 PM UTC

SanderMak wrote: post #16

So is there already a solution for https on Github Pages with a custom domain?

Check out netlify (https://www.netlify.com) - we're like GitHub Pages on steroids (integrated continuous deployment, proxying, redirect and rewrite rules + lots of other features) and we launched free SSL on custom domains a couple of weeks ago :)

Re: Google Will Soon Shame All Websites That Are Unencrypted

#55

Post by pfg » Wed, Jan 27, 2016, 9:32 PM UTC

bjblazkowicz wrote: post #35

So what about the overhead of https?

https://istlsfastyet.com/

Re: Google Will Soon Shame All Websites That Are Unencrypted

#56

Post by geofft » Wed, Jan 27, 2016, 9:33 PM UTC

pjc50 wrote: post #41

So is there a lets encrypt solution for shared-hosting systems?

It looks like `letsencrypt-auto --webroot` does this: https://letsencrypt.org/howitworks/

If your shared host has a way to automate deployment of new SSL certificates, this should be easy. (Or if they're willing to manually configure a new cert every 3 months.)

Re: Google Will Soon Shame All Websites That Are Unencrypted

#57

Post by mikecb » Wed, Jan 27, 2016, 9:35 PM UTC

pjc50 wrote: post #41

So is there a lets encrypt solution for shared-hosting systems?

Domain validation is coming, which makes things easier, but some like Dreamhost are adding one click support to their hosting panels, and openly talk about making it default.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#58

Post by schoen » Wed, Jan 27, 2016, 9:36 PM UTC

bcg1 wrote: post #48

pmlnr wrote: post #17

Earlier quoted context omitted.

nada. http://letsencrypt.org/

Most shared hosting accounts charge extra for a dedicated IP address, both for setup and on a monthly basis. Don't underestimate how many blogs, churches, small businesses, etc still use services like that. To be fair, many of those sites probably ARE insecure, but it seems to be a little bit overkill to "shame" them for not implementing encryption.

You only need a dedicated IP address for clients that don't support SNI. If your hosting model supports it, you can also still support these clients with a single IP address with a SAN cert that includes all of the possible hostnames.

Re: Google Will Soon Shame All Websites That Are Unencrypted

#59

Post by forgottenpass » Wed, Jan 27, 2016, 9:36 PM UTC

rwmj wrote: post #31

aembleton wrote: post #25

Earlier quoted context omitted.

Because you need to create a public key for the browser to use.

SSH gets this right -- create a host key when the server is installed, and have the client check the key and only warn/error when it changes. Sure, this isn't super-secure for first time visitors to their banking website or whatever, but those websites can continue to use the current system.

SSH gets this right

No, it doesn't.

When was the last time you verified a host key out of band?

And if you're using SSH, you know well enough to know why you should do the damn legwork to verify the key. What do you expect for end users?

Furthermore, if nobody is doing out of band verification on the first pass, how do you expect users to distinguish between an attack and legit host key change?

Re: Google Will Soon Shame All Websites That Are Unencrypted

#60

Post by JoshTriplett » Wed, Jan 27, 2016, 9:36 PM UTC

bcg1 wrote: post #48

pmlnr wrote: post #17

Earlier quoted context omitted.

nada. http://letsencrypt.org/

Most shared hosting accounts charge extra for a dedicated IP address, both for setup and on a monthly basis. Don't underestimate how many blogs, churches, small businesses, etc still use services like that. To be fair, many of those sites probably ARE insecure, but it seems to be a little bit overkill to "shame" them for not implementing encryption.

SSL hasn't required a separate IP since Windows XP. And XP no longer has any security support, so anyone running it has bigger problems.