Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

One of the Most Alarming Internet Proposals I've Seen

lauren.vortex.com

Post reply on HN
Print view View original

71–80 of 95 posts

Re: One of the Most Alarming Internet Proposals I've Seen

#71

Post by mst »

quotemstr wrote: post #14

Er, actually reading the specification, it's about proxying http resources, not https ones. This proposal is strictly better than the transparent proxying that's common on the internet today. To distinguish between an HTTP2 connection meant to transport "https" URIs resources and an HTTP2 connection meant to transport "http" URIs resource, the draft proposes to register a new value in the Application Layer Protocol n…

I think the crucial thing to understanding this is this diagram -

               UserAgent             Proxy                 Server
                      TLS Session #1        TLS Session #2
                             
                                     HTTP
which makes it clear that the point is to be able to say "I trust this proxy sufficiently that I'm ok with it acting as an intermediary, but I still don't want my stuff in the clear between me and the proxy or between the proxy and the far end server."

So it's about enabling the user to trust -only- the proxy, whereas currently in order to get utility out of a proxy you need to send the traffic as plain HTTP which then trusts both the proxy and the networks over which the data will travel.

That seems to me to absolutely meet the requirements for "strictly better".

Re: One of the Most Alarming Internet Proposals I've Seen

#72

Post by [deleted] »

hobohacker wrote: post #40
wmf wrote: post #21

This article ignores the context behind the proposal. Many companies, schools, and prisons are MITMing all SSL traffic today for a variety of liability reasons. Today those users get no notice that their Web browsing is being observed and censored. Trusted proxies are intended to give those users some notice that they're being MITMed. I agree that MITM proxies shouldn't be used on the public Internet and thus we shou…

As Patrick McManus says in http://lists.w3.org/Archives/Public/ietf-http-wg/2013OctDec/... : If someone can install a root cert onto your computer then you are already owned - there is no end to the other things they can do too. Call it a virus, call it an enterprise, but call it a day - you're owned and there is no in-charter policy this working group can enact to change the security level of that user for good or f…

[deleted]

Re: One of the Most Alarming Internet Proposals I've Seen

#73

Post by crististm »

droopybuns wrote: post #68

Carriers are fighting against being turned into dumb pipes. Google is fighting to turn carriers into dumb pipes. I can't take this Google consultant seriously in that context.

Carriers _are_ dumb pipes. Carriers are fighting to get rid of that. Internet _is_ dump pipes connected together. Carriers are fighting against that.

Re: One of the Most Alarming Internet Proposals I've Seen

#74

Post by mnot »

StavrosK wrote: post #24
gojomo wrote: post #13

Earlier quoted context omitted.

The web is long overdue for a method to specify an exact resource, by content-hash, from one-of-whatever-sources. Those sources can then be other less-secure protocols, even those unanticipated by the referrer, because the client got the necessary verifier via the secure-path.

That's actually a very good idea... Browsers could load the jquery file in your cache by its hash, rather than its URL. No more having 100 copies of jquery.min.js in your cache just because they're from different URLs.

Precisely this is actively being discussed in the W3C WebAppSec WG: http://w3c.github.io/webappsec/specs/subresourceintegrity/

The security folks I talk to are... nervous... about this use of subresource integrity, however.

Re: One of the Most Alarming Internet Proposals I've Seen

#75

Post by hobohacker »

derefr wrote: post #60
bbatsell wrote: post #30

Earlier quoted context omitted.

HTTP/2 changes the meaning of the http:// scheme. All connections will now be TLS-encrypted. (Edit: Maybe not. See hobohacker below.) http:// means that the endpoint has not been verified using the CA system and is using a self-signed certificate (and is thus trivially vulnerable to a MITM should certificate keys not be checked out-of-band). The purpose is to provide confidentiality to the vast majority of traffic, e…

> This proposal's purpose is to ... expose all traffic using the http:// scheme to your ISP, exactly as it is today. Isn't that a semantic requirement of HTTP, though? Half of the "tech" in the HTTP/1.X spec is to allow for caching of resources and responses by proxies, allowing anyone between the client and server (e.g. your ISP) to act as a CDN. HTTPS/1.X effectively throws that away by doing end-to-end encryption.…

I don't see why you think this is a semantic requirement of HTTP. Perhaps there's some confusion over what HTTP semantics are. Let me refer you to http://tools.ietf.org/html/draft-ietf-httpbis-p2-semantics-2.... It doesn't discuss exposing all HTTP traffic to network intermediaries. Perhaps you're thinking of the HTTP messaging layer http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging-2.... Also, I think your statement about allowing an in-path intermediary to act as a CDN is weird, since a CDN is defined as "a large distributed system of servers deployed in multiple data centers across the Internet. The goal of a CDN is to serve content to end-users with high availability and high performance." [1].

It's true, HTTPS is full of tradeoffs. You've identified some of them.

What do you see in HTTP/2 that "codifies this workaround"? That wasn't immediately obvious to me. Recall that HTTP/2 is basically just multiplexing with prioritized streams. There's no requirement on TLS in the spec, although all current browser deployments (of SPDY) require TLS.

[1]: http://en.wikipedia.org/wiki/Content_delivery_network

Re: One of the Most Alarming Internet Proposals I've Seen

#76

Post by derefr »

zmanian wrote: post #66
derefr wrote: post #60

Earlier quoted context omitted.

> This proposal's purpose is to ... expose all traffic using the http:// scheme to your ISP, exactly as it is today. Isn't that a semantic requirement of HTTP, though? Half of the "tech" in the HTTP/1.X spec is to allow for caching of resources and responses by proxies, allowing anyone between the client and server (e.g. your ISP) to act as a CDN. HTTPS/1.X effectively throws that away by doing end-to-end encryption.…

I find it difficult to imagine a world where Applications agnostic caching for encrypted sessions is possible. I fully expect a world where application developers have services at their disposal for positioning assets closer to the end user with VM instance level isolation and security guarantees. Transport level security is not likely to be enough for high value/sensitivity data in the long run but adding a bunch of…

Why application-agnostic? HTTP's own caching isn't application-agnostic; it relies on the server to specify Cache-Control headers.

I would imagine an ideal HTTP2 caching protocol to basically specify that some resources can come from anywhere, as long as the retrieved result conforms to an attached content hash—while also specifying a primary source to get the resource from, if you don't have a DHT handy. (Oddly enough, this is basically a suggestion that web browsers try to resolve magnet: URNs.)

Re: One of the Most Alarming Internet Proposals I've Seen

#77

Post by lifeisstillgood »

TophWells wrote: post #59
lifeisstillgood wrote: post #43

Ok - here is a suggestion: The Right to root. Just as a citizens letters, papers and home are inviolable, should our new papers our new homes be also inviolable - if I own a device, No-one should legally be allowed control over it?

>if I own a device, No-one should legally be allowed control over it? Then tech companies might start leasing out their devices: you technically don't own it, so you're not allowed to do what you want to it. Not that the Right to Root wouldn't be nice, but the change in attitude has to come first. And we need to somehow convince the likes of Apple that their DRM is bad for business.

if someone leases me a notebook, do they get the right to read what I write in it? seems unlikely.

Re: One of the Most Alarming Internet Proposals I've Seen

#78

Post by SudoNick »

userbinator wrote: post #50

The amusing thing about this is that MITM can also be used to one's personal benefit -- I run a local filtering proxy that strips off most of the crap on the majority of sites, and I've had to do a bit of hex editing to be able to do that without the browser complaining. Look at it another way: With browsers becoming more and more unconfigurable and nearing the point of being user-hostile, it is any wonder that the c…

Yes! If you don't have a reasonably easy way to inspect and modify what is being sent over the encrypted connections your device makes, you are in very serious trouble. Your device will be [ab]used against you.

Re: One of the Most Alarming Internet Proposals I've Seen

#79

Post by gojomo »

mnot wrote: post #74
StavrosK wrote: post #24

Earlier quoted context omitted.

That's actually a very good idea... Browsers could load the jquery file in your cache by its hash, rather than its URL. No more having 100 copies of jquery.min.js in your cache just because they're from different URLs.

Precisely this is actively being discussed in the W3C WebAppSec WG: http://w3c.github.io/webappsec/specs/subresourceintegrity/ The security folks I talk to are... nervous... about this use of subresource integrity, however.

Can you say any more about what makes them nervous? (What do they think will go wrong?)

Re: One of the Most Alarming Internet Proposals I've Seen

#80

Post by friendzis »

TophWells wrote: post #59
lifeisstillgood wrote: post #43

Ok - here is a suggestion: The Right to root. Just as a citizens letters, papers and home are inviolable, should our new papers our new homes be also inviolable - if I own a device, No-one should legally be allowed control over it?

>if I own a device, No-one should legally be allowed control over it? Then tech companies might start leasing out their devices: you technically don't own it, so you're not allowed to do what you want to it. Not that the Right to Root wouldn't be nice, but the change in attitude has to come first. And we need to somehow convince the likes of Apple that their DRM is bad for business.

Wasn't that written from a mac/ipad?
Post reply on HN