I work for a large bank and a lot of "lesser known" SSL sites (eg blogs that have a cert) are just straight off blocked by the bluecoat proxy.
Why isn't HTTPS everywhere yet?
71–80 of 130 posts
Re: Why isn't HTTPS everywhere yet?
#72When I lived in China I was pretty happy the https movement hadn't won yet. Sites that forced me on a secure line were basically useless. The great firewall doesn't appreciate encrypted connections, and will usually grind to a halt, when deciding if it will let you get the content.
Isn't it the contrary. If Internet would be practically unavailable in China except for domestic resources, due to every single server using TLS for absolutely anything — would Great Firewall survive?
The Great Firewall only applies to traffic coming in and out of China. Domestic Internet surveillance and filtering is handled by Golden Shield.
If all Chinese domestic traffic used TLS, nothing would change. The PRC Government can still knock on the door if your company is causing trouble.
Re: Why isn't HTTPS everywhere yet?
#73"Why isn't HTTPS everywhere yet?": Because it makes absolutely no sense for the vast majority of online content. Email in https ? Sure. Reading news sites in https ? Accessing RFC in https ? My favorite online recipe site in https ? A total waste of money and CPU. Oh, and sure, the problem has been "solved" for few geeks using the latest browsers accepting let's encrypt certificates. Sure.
Even if you don't care about secrecy/privacy, things like this [1,2] and this [3] are reasons to do everything under HTTPS.
[1] https://news.ycombinator.com/item?id=10926696
[2] https://labs.mwrinfosecurity.com/blog/2013/09/24/webview-add...
Re: Why isn't HTTPS everywhere yet?
#74Cost is going to be taken care of by let's encrypt.
I am surprised complexity of setting up SSL isn't mentioned in the article.
First the tools are complex to use, use various formats for storing keys that are incompatible. In Linux you pretty much have to rely on cryptic command lines. Windows is slightly simpler. And you need more tools to convert certificates between the different formats (for instance using an IIS certificate with FileZilla).
Then you have to deal with the complexity of the algorithms used, the fact that chrome won't accept sha1 anymore, the fact that http2 is very picky in the cryptographic methods used.
What is a best practice today breaks tomorrow. For instance the following script written only a couple of years ago shows how to set up windows to get an A on SSLLabs:
https://www.hass.de/content/setup-your-iis-ssl-perfect-forwa...
But with IIS10 / http2, this list of ciphers is incompatible with chrome. I found a list that works here:
https://code.google.com/p/chromium/issues/detail?id=529994
but I am sure it will break older browsers.
Etc, etc, etc. This is hard work. Until setting up SSL will be a simple box to tick in IIS or a single setting to change in apache, only developers who really care about security and are really motivated will deal with this shit.
Re: Why isn't HTTPS everywhere yet?
#75Earlier quoted context omitted.
It doesn't require a static IP; you can use SNI to use HTTPS on a shared IP: https://en.wikipedia.org/wiki/Server_Name_Indication SNI was already been mentioned an hour ago, too: https://news.ycombinator.com/item?id=10928036
Interesting, I hadn't heard of that. Perhaps I should make a correction -- on the webhost my small business uses, purchasing a static IP is required for SSL support. I was under the impression this was a technical limitation, but I was apparently wrong.
> I was under the impression this was a technical limitation
It was, but one that is becoming less and less relevant finally.
The problem comes from not knowing the host name until after the SSL/TLS channel has been negotiated, so the server doesn't know which certificate to hand out unless there is only one that is relevant for a given address.
SNI has been widely supported server-side and on up-to-date client applications for a long time, this is essentially a change to the protocol whereby the client tells the server which site it is looking for as part of the SSL/TLS negotiation so there is no problem providing the right certificate during that process. It has been supported by cPanel since the beginning of 2014, and presumable the competing shared host control panels too, so if your host is up-to-date then SNI should be available (if your host is running a 2014-or-before build of the control panel, move host now as they are likely vulnerable to a variety of security issues).
Unfortunately "up-to-date client applications" has been the sticking point: no version of Internet Explorer running on XP supports SNI, nor do older mobile browsers. Your site would still work on those older browsers but the user would get a security warning on each visit which is not desirable. Browsers that old are getting less common, and are getting locked out already because of protocol/cypher changes intended to mitigate recently discovered attacks against SSL/TLS, so SNI is an increasingly practical option (how practical is your decision: can you afford to potentially scare off that remaining small percentage of potential users? Personally I say "definitely yes, people that out-of-date are a nightmare to support anyway so my competitors can have them").
Of course IPv6 also fixes the issue too, but adoption of that lags behind the adoption of SNI compatible browsers by a long way.
Re: Why isn't HTTPS everywhere yet?
#76Another big blocker is cost. For example, one of the biggest CDNs in the world (I'm looking at you, Akamai), charge dramatically more for delivering content over HTTPS. Let's say you're delivering video content at scale, the difference between HTTP and HTTPS delivery can be many millions of dollars a year. But why not use a different CDN, say Cloudfront which prices the same for HTTP and HTTPS?, well, simple, the sam…
Also Heroku's price for serving https with your own domain is absurdly high.
I basically means there is not free version of Heroku for serious projects, which is ok. But taken in isolation, the price tag looks pretty bad..
Re: Why isn't HTTPS everywhere yet?
#77HTTPS (in the current form) adds a dependency on external authority. This breaks the very fundamental principle of the web.
Re: Why isn't HTTPS everywhere yet?
#78Earlier quoted context omitted.
> Because it makes absolutely no sense for the vast majority of online content. Hey, not so fast with conclusions, please. Do you want an ISP filling your recipe reading with their advertisements. Nope? Or a random dude spoofing a Starbucks WiFi hotspot and serving you a malware on what you think is a trusted download site. Still no? That's what TLS is for. Not for random paranoid geeks or "just email and online paym…
> Do you want an ISP filling your recipe reading with their advertisements. Thought this would go in a direction where your ISP changes the ingredients :)
If there is a fraction of a $ to be made per instance by replacing references to (for example) Nutella with references and referral links to some other spread I'm sure it would happen somewhere, and might change the outcome of the recipe in terms of taste/texture or worse make people ill if a recipe avoiding particular allergens ends up with the wrong product being recommended.
Re: Why isn't HTTPS everywhere yet?
#79Earlier quoted context omitted.
> Lets Encrypt certs are equivalent to self-signed certs. This is entirely false.
Oh yeah! sure... what exactly ensures that the DV cert is a DV cert?
what exactly ensures that the DV cert is a DV cert?
The fact that IdenTrust says it's a DV cert, and browsers trust its claims.
Re: Why isn't HTTPS everywhere yet?
#80Still no mention about ads. Using HTTPS means you have to load ads over HTTPS and a huge number of ad networks are not reachable over HTTPS and another large number of assets / tags are hard coded to fetch HTTP resources. For any ad supported website, HTTPS will cause a significant loss of ad revenue. Given how long it's taking the industry to transition away from Flash I'm not holding my breath about this being fixe…
the advertisement problem is a subset (albeit a rather large one) of mixed content; the article does make some references to it.