Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS by default

security.googleblog.com

Post reply on HN
Print view View original

61–70 of 268 posts

Re: HTTPS by default

#61

Post by ozim »

kevstev wrote: post #25
sam_lowry_ wrote: post #12

Earlier quoted context omitted.

I run my blog in unencrypted HTTP/1.1 just to make a point that we do not have to depend on third parties to publish content online. And I noticed that Whatsapp is even worse than Chrome, it opens HTTPS even if I share HTTP links.

There are dozens of us I guess that care about this kind of thing. I have never really understood the obsession with https for static content that I don't care if anyone can see I am reading like a blog post. HTTPS should be for things that matter, everything else can, and think should use HTTP when it is not necessary. Depending on yet another third party to provide what is IMHO a luxury should not be required, and…

You just clearly don’t understand it is important that no one injects anything into your code while I am browsing it.

With http it is trivial.

So you say you don’t care if my ISP injects whole bunch of ads and I don’t even see your content but only the ads and I blame you for duping me into watching them.

Nowadays VPN providers are popular what if someone buys VPN service from the shitty ones and gets treated like I wrote above and it is your reputation of your blog devastated.

Re: HTTPS by default

#62

Post by kaoD »

ndriscoll wrote: post #53
kstrauser wrote: post #46

Earlier quoted context omitted.

> HTTPS should be for things that matter If that were the universal state, then it would be easy to tell when someone was visiting a site that mattered, and you could probably infer a lot about it by looking at the cleartext of the non-HTTPS side they were viewing right before they went to it.

You can already see what site someone visits with HTTPS. It's in the Client Hello, and is important for things like L4 load balancing (e.g. HAProxy can look at the host to choose what backend to forward the TCP packets for that connection to without terminating TLS). It's also important for network operators (e.g. you at home) to be able to filter unwanted traffic (e.g. Google's).

https://blog.cloudflare.com/announcing-encrypted-client-hell...

Re: HTTPS by default

#63

Post by sam_lowry_ »

ozim wrote: post #61
kevstev wrote: post #25

Earlier quoted context omitted.

There are dozens of us I guess that care about this kind of thing. I have never really understood the obsession with https for static content that I don't care if anyone can see I am reading like a blog post. HTTPS should be for things that matter, everything else can, and think should use HTTP when it is not necessary. Depending on yet another third party to provide what is IMHO a luxury should not be required, and…

You just clearly don’t understand it is important that no one injects anything into your code while I am browsing it. With http it is trivial. So you say you don’t care if my ISP injects whole bunch of ads and I don’t even see your content but only the ads and I blame you for duping me into watching them. Nowadays VPN providers are popular what if someone buys VPN service from the shitty ones and gets treated like I…

My ISP does not and if yours does, vote with your money or lobby your government to make this illegal.

And while at it, lobby to make corporate MiTM tools illegal as well.

Because if you are bothered about my little blog, you should be bothered that your employer can inspect all your HTTPS traffic.

Re: HTTPS by default

#64

Post by kstrauser »

ndriscoll wrote: post #53
kstrauser wrote: post #46

Earlier quoted context omitted.

> HTTPS should be for things that matter If that were the universal state, then it would be easy to tell when someone was visiting a site that mattered, and you could probably infer a lot about it by looking at the cleartext of the non-HTTPS side they were viewing right before they went to it.

You can already see what site someone visits with HTTPS. It's in the Client Hello, and is important for things like L4 load balancing (e.g. HAProxy can look at the host to choose what backend to forward the TCP packets for that connection to without terminating TLS). It's also important for network operators (e.g. you at home) to be able to filter unwanted traffic (e.g. Google's).

I don't think seeing the site is too important, although there are TLS extensions to encrypt that, too[0]. In practice, a huge chunk of sites still have unique IPs, so seeing that someone is connecting to 1.2.3.4 gives you a pretty good idea of what site they're visiting. That's even easier if they're using plaintext DNS (i.e. instead of DoH) so that you can correlate "dig -t a example.com => 1.2.3.4" followed immediately by a TCP connection to 1.2.3.4. CDNs like Cloudflare can mitigate that for a lot of sites, but not millions of others.

However, the page you're fetching from that domain is encrypted, and that's vastly more sensitive. It's no big deal to visit somemedicinewebsite.com in a theocratic region like Iran or Texas. It may be a very big deal to be caught visiting somemedicinewebsite.com/effective-abortion-meds/buy. TLS blocks that bit of information. Today, it still exposes that you're looking at plannedparenthood.com, until if/when TLS_ECH catches on and becomes pervasive. That's a bummer. But you still have plausible deniability to say "I was just looking at it so I could see how evil it was", rather than having to explain why you were checking out "/schedule-an-appointment".

[0]https://developers.cloudflare.com/ssl/edge-certificates/ech/

Re: HTTPS by default

#65

Post by giancarlostoro »

marginalia_nu wrote: post #17

http://www.slackware.com/ is probably the biggest website I'm aware of that does not serve encrypted traffic[1]. but there are a few other legitimately useful resources that don't encrypt. [1] (Except on the arm subdomain for some reason)

My first distro was Slackware. Good memories. The ARM subdomain looks drastically more maintained, posts from 2025.

Don't ever view source on slackware.com

Re: HTTPS by default

#66

Post by dadrian »

sam_lowry_ wrote: post #34
vhcr wrote: post #21

Earlier quoted context omitted.

Depend on one less third party, you still depend on the DNS Root servers, your ISP / hosting, domain registry, etc.

Let's Encrypt pushes me to run its self-updating certbot on my personal server, which is a big no-go. I know about acme.sh, but still...

Let's Encrypt does not write or maintain certbot

Re: HTTPS by default

#67

Post by dadrian »

srcreigh wrote: post #41
dadrian wrote: post #31

Earlier quoted context omitted.

Non-unique hostnames, which are RFC 1918 space, single-label hostnames, and addresses assigned to mDNS (.local).

Single label hostnames had an issue where it’s hard to type them into a browser. How to fix this?

Add a /, e.g. `shortname/`

Re: HTTPS by default

#68

Post by billyhoffman »

IgorPartola wrote: post #26

I distinctly remember trying to sign up for Pandora’s premium plan back in 2012 and their credit card form being served and processed over HTTP. I emailed them telling them that I wanted to give them my money if they would just fix the form. They never got back to me or fix it for several more years while I gave my money to Spotify. Back then HTTPS was NOT the norm and it was a battle to switch people to it. Yes it i…

In the early to mid 2000s I would believe this. But for a major e-commerce provider in 2012? That seems vanishing improbable.

PCI DSS is the data security standard required by credit card processors for you to be able to accept credit card payments online. Since version 1.0 came out in 2004, Requirement 4.1 has been there, requiring encrypted connections when transmitting card holder information.

There’s certainly was a time when you had two parts of a commerce website: one site all of the product stuff and catalogs and categories and descriptions which are all served over HTTP (www.shop.com) and then usually an entirely separate domain (secure.shop.com) where are the actual checkout process started that used SSL/TLS. This was due to the overhead of SSL in the early 2000s and the cost of certificates. This largely went away once Intel processors got hardware accelerated instructions for things like AES, certificates became more cost-effective, and then let’s encrypt made it simple.

Occasionally during the 2000s and 2010s you might see HTML form that were served over HTTP and the target was an HTTPS URL but even that was rare simply because it was a lot of work to make it that complex instead of having the checkout button just take you to an entirely different site

Re: HTTPS by default

#69

Post by bullen »

sam_lowry_ wrote: post #12
tialaramex wrote: post #7

I have had HTTPS-by-default for years and I can say that we're past the point where there's noticeable year-to-year change for which sites aren't HTTPS. It's almost always old stuff that pre-dates Let's Encrypt (and presumably just nobody ever added HTTPS). The news site which stopped updating in 2007, the blog somebody last posted to in 2011, that sort of thing. I think it's important to emphasise that although Tim'…

I run my blog in unencrypted HTTP/1.1 just to make a point that we do not have to depend on third parties to publish content online. And I noticed that Whatsapp is even worse than Chrome, it opens HTTPS even if I share HTTP links.

I made this to redirect HTTPS to HTTP with whatsapp:

https://multiplayeronlinestandard.com/goto.html (the reason for the domain is I will never waste time on HTTPS but github does it automatically for free up to 100GB/month)

Re: HTTPS by default

#70

Post by bigfatkitten »

sam_lowry_ wrote: post #55
kaoD wrote: post #40

Earlier quoted context omitted.

Just because you don't care doesn't mean nobody cares. I don't want anyone snooping on what I browse regardless of how "safe" someone thinks it is. My navigation habits are boring but they are mine , not anyone else's to see. A server has no way to know whether the user cares or not, so they are not in a position to choose the user's privacy preferences. Also: a page might be fully static, but I wouldn't want $GOVERN…

So... do you refuse to use the laptop supplied by your employer? It does MITM between you and the HTTPS websites you browse.

Using an employer-issued computer for anything but work for that employer is foolish, for a multitude of legal and other reasons. Privacy is just one of them.
Post reply on HN