Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Should All Web Traffic Be Encrypted?

codinghorror.com

Post reply on HN
Print view View original

61–70 of 136 posts

Re: Should All Web Traffic Be Encrypted?

#61

Post by rogerbinns »

SoftwareMaven wrote: post #47

Just Tuesaday, I sent an email around the company discussing SSL vulnerabilities, how they impact our product, and ways we can mitigate that. I've pulled out the parts specific to our product, but the rest may be interesting. I would love feedback on things I may have missed. FWIW, it doesn't instill great confidence in SSL, but it isn't completely horrible. ------------------------ 1. It is possible to pretend to be…

Expanding on 1) you can also play man in the middle, decrypt and resign traffic with your own faked CA. If you ever have access to the users' machine you can install your faked CA as trusted and could have done it long in advance (eg via trojans/viruses).

When I was working on WAN optimizers I actually did this during research. All the various sites I visited still proudly told me how they were "Verisign Trusted" and even clicking on "Verify" links would tell me how verified and correct it was.

The UI in the browsers tries hard, but in reality users want to access the site and they will hit OK to get there. convergence is nice (if you run Firefox) but it is of significantly less help when using corporate/intranet sites.

Re: Should All Web Traffic Be Encrypted?

#63

Post by marshray »

match wrote: post #56
agl wrote: post #13

Earlier quoted context omitted.

I assure you that it's true. I haven't reprofiled in that much detail since but I suspect that the numbers look even better now. Partly because computers are faster and partly because of software improvements.

It largely depends up the nature of your web service. If you are running a user-interactive site theb i may buy it. However if you are offering a high-tps, high-throughput web service I assure you the costs of switching 100% of your users to SSL is not negligable and has a real impact on the customer experience.

I think agl is familiar with both kinds. His company tends to serve both the HTML and the APIs through the same set of load balancers.

Re: Should All Web Traffic Be Encrypted?

#64

Post by marshray »

dredmorbius wrote: post #43
mcherm wrote: post #27

Earlier quoted context omitted.

If the content of the email were hshed then the recipient couldn't read it!

They could if it were a reversible key-based hash. http://en.wikipedia.org/wiki/Cryptographic_hash_function

I believe you're thinking of a 'cipher'.

Cryptographic hashes (even keyed ones) are expected to be one-way functions.

Re: Should All Web Traffic Be Encrypted?

#65

Post by marshray »

revelation wrote: post #8

Yes, please, encrypt all the things, but absolutely don't use HTTPS to do it. See Daniel J. Bernsteins pet project CurveCP ( http://curvecp.org/ ). He also had a talk on 27C3 ( http://events.ccc.de/congress/2010/Fahrplan/events/4295.en.h... ).

How do you propose to use CurveCP to encrypt "all the" HTTP without involving HTTPS?

Re: Should All Web Traffic Be Encrypted?

#66

Post by newman314 »

patrickaljord wrote: post #9

Funny that https://stackoverflow.com/ certificate is not valid.

Well, it's a cert for stackexchange.com and not stackoverflow.com.

They need to be serving a different cert on a different IP for that (ignoring SNI since not all browsers support it).

Re: Should All Web Traffic Be Encrypted?

#68

Post by agl »

SoftwareMaven wrote: post #47

Just Tuesaday, I sent an email around the company discussing SSL vulnerabilities, how they impact our product, and ways we can mitigate that. I've pulled out the parts specific to our product, but the rest may be interesting. I would love feedback on things I may have missed. FWIW, it doesn't instill great confidence in SSL, but it isn't completely horrible. ------------------------ 1. It is possible to pretend to be…

1) You can address it in Chrome with pinning [1]. Built in pins require that you be a significant site, but you can also set them with HTTP headers [2].

[1] http://www.imperialviolet.org/2011/05/04/pinning.html [2] http://tools.ietf.org/html/draft-ietf-websec-key-pinning-01

This is a rather poor solution. The longer term one is Certificate Transparency: http://www.links.org/?p=1219

2) is solved with HSTS [3]. You can contact me (@chromium.org) to be built in. There isn't a notability requirement.

[3] http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

3) The BEAST attack was tough to pull off and is fixed with Chrome, FF10 and IE.

http://www.imperialviolet.org/2012/01/15/beastfollowup.html

4) Yep, cookies must be marked secure. HSTS can also fix this my eliminating the insecure requests. Even with secure cookies (but without HSTS), a MITM can also set the cookie. (i.e. to log you in to their account before you hit 'send' and then to log you back into yours before you notice the problem.)

Re: Should All Web Traffic Be Encrypted?

#69

Post by marshray »

rogerbinns wrote: post #61
SoftwareMaven wrote: post #47

Just Tuesaday, I sent an email around the company discussing SSL vulnerabilities, how they impact our product, and ways we can mitigate that. I've pulled out the parts specific to our product, but the rest may be interesting. I would love feedback on things I may have missed. FWIW, it doesn't instill great confidence in SSL, but it isn't completely horrible. ------------------------ 1. It is possible to pretend to be…

Expanding on 1) you can also play man in the middle, decrypt and resign traffic with your own faked CA. If you ever have access to the users' machine you can install your faked CA as trusted and could have done it long in advance (eg via trojans/viruses). When I was working on WAN optimizers I actually did this during research. All the various sites I visited still proudly told me how they were "Verisign Trusted" and…

It's not a "faked CA", it's a perfectly legitimate "internal CA" you created.

Of course you may be using it to impersonate external websites to your internal users, but the circumstances under which that may be an OK thing to do is a policy question that's still evolving.

Re: Should All Web Traffic Be Encrypted?

#70

Post by tghw »

ohashi wrote: post #51
TomGullen wrote: post #45

Lesser known HTTP feature that I love, instead of linking to resources like follows: http://static4.scirra.net/images/favicon.ico /> You should link as follows: The double forward slash will select the current protocol the page is being viewed on which means no security errors if you're switching between http/https!

That is a neat trick, does it work on all browsers?

It does, although IE 7 (and possibly 6) have a bug where they will double request the resource. But, honestly, if they're on IE6 or IE7, the web isn't fast for them anyways.
Post reply on HN