Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deprecating Non-Secure HTTP

blog.mozilla.org

Post reply on HN
Print view View original

71–80 of 318 posts

Re: Deprecating Non-Secure HTTP

#71

Post by jsn »

I envy you, citizens of the free world :) You (mostly) can use HTTPS, avoid government surveillance, and use new shiny Mozilla features (for whatever they are going to be).

It's not the same in e.g. Russia (and I'm sure it's not just Russia). In Russia, the Web is now officially being censored by the state. They have a national register of prohibited resources -- basically, a huge list of URLs. Every ISP must block all access to those URLs, or else.

So if a page (perhaps, a comment page?) on your site enters the register, and it is served over unencrypted HTTP, ISPs can use DPI to block the access to just that specific page -- which sucks, but at least your site is still accessible. If, however, you use HTTPS -- then ISPs have no other choice but to block all traffic to your site entirely. Given that choice, many webmasters (myself included) will have to choose plain HTTP.

Re: Deprecating Non-Secure HTTP

#72

Post by MichaelApproved »

finnn wrote: post #60
nosefrog wrote: post #22

I should be happy about this -- who wouldn't want the entire web to be encrypted -- but SSL is so broken for normal people. SSL is expensive (wildcard certificates run $70 a year and up), confusing (how does one pick between the 200 different companies selling certificates?), and incredibly difficult to set up (what order should I cat the certificate pieces in again?). If SSL doesn't change, this move will cut the li…

$70 for a wildcard cert!? Where are you looking at? There's a shitload of AlphaSSL resellers that are much cheaper. I got 2 wildcard certs for $20/yr. Of course, there's really no need for a wildcard certificate, and StartCom gives out free, valid non-wildcard certs right now . On top of that, Lets Encrypt should simplify the process greatly.

People always tout StartCom as a free provider (which is really great) but they forget to mention that it's only free for personal use.

StartCom offers the free (for personal use) Class 1 X.509 SSL certificate "StartSSL Free"

http://en.wikipedia.org/wiki/StartCom

Re: Deprecating Non-Secure HTTP

#73

Post by joelrunyon »

adventured wrote: post #37
joelrunyon wrote: post #23

Earlier quoted context omitted.

Seriously, SSLs basically 2x the hosting cost for low end hosting packages. Not great for people running small websites.

SSL should be a universally available free resource. I expect that it will be in the near future. That said, it is still very cheap for small sites too: $9 - $11 / year for perfectly good certs. Less than $1 per month is a small burden. https://www.namecheap.com/security/ssl-certificates/domain-v...

but you have to get a dedicated IP as well, which means you can host less sites on a small server - something bad for smaller biz.

Re: Deprecating Non-Secure HTTP

#75

Post by teraflop »

tracker1 wrote: post #40
JoshTriplett wrote: post #20

Earlier quoted context omitted.

Yes; localhost specifically counts as secure.

Hopefully they put in a whitelist option... (similar to IE's security zones)... so you can whitelist your development domains.. in the case of hostnames, or when you hit a local VM. I agree with another comment that a red broken lock for HTTP connections would be a better approach.

Chrome is proposing the same thing as Firefox (deprecating advanced features over HTTP) and additionally wants to visually mark HTTP connections as insecure: https://www.chromium.org/Home/chromium-security/marking-http...

Re: Deprecating Non-Secure HTTP

#76

Post by beeworker »

UnoriginalGuy wrote: post #7

I agree with trying to phase out HTTP, but I think their method is "annoying." What do features have to do with HTTP Vs. HTTPS? It just seems like an arbitrary punishment. Wouldn't it just be significantly easier to simply change the URL art style to make clear that HTTP is "insecure." Like a red broken padlock on every HTTP page? That has the following advantages: - HTTP remains fully working for internal/developmen…

While we're making art style changes, why don't we change the experience for self-signed certs?

When the user first visits an HTTPS page with a self-signed cert, they get the content, and the URL art style has a broken lock or something warning it's not known to be secure. (It's better than raw HTTP but it's not trusted.) With certificate pinning by the browser, the next time the user visits that page, if it's different, then they get the current experience that warns them in big scary text and requires several clicks to get past. There's a question of if it's different in that the server owner upgraded to a paid SSL cert should it show a warning or not, but if there's a way to sign that upgrade with the old cert that the browser can know about there shouldn't be a problem...

Re: Deprecating Non-Secure HTTP

#77

Post by peteretep »

bashinator wrote: post #58
nosefrog wrote: post #22

I should be happy about this -- who wouldn't want the entire web to be encrypted -- but SSL is so broken for normal people. SSL is expensive (wildcard certificates run $70 a year and up), confusing (how does one pick between the 200 different companies selling certificates?), and incredibly difficult to set up (what order should I cat the certificate pieces in again?). If SSL doesn't change, this move will cut the li…

As an aside, I really don't like wildcard certs. If the private key is compromised, the consequences are so much worse than if you lose a regular cert.

Why is compromise of a cert that can sign ".moo.bar.foo.baz.com" so* much worse than compromise of one that can sign "www.moo.bar.foo.baz.com"?

Re: Deprecating Non-Secure HTTP

#78

Post by NeutronBoy »

[deleted] wrote: post #74

[deleted]

Thank god we have technology to serve multiple SSL sites on the same IP!

And yes, while SNI isn't supported on older platforms (namely XP and Android 2.x), those platforms are out of support anyway. Part of this push is for security - people on those platforms won't be any worse off anyway (except for getting warning messages).

Re: Deprecating Non-Secure HTTP

#79

Post by peteretep »

kazinator wrote: post #47

This is stupid. There are all kinds of use cases where you don't care who knows what you're looking at, or whether it is authentic. Say I navigate to some restaurant's web page using HTTP. Even if I used HTTPS, someone spying on my traffic would know what I'm reading, if the IP address is a dedicated server for that web site only. Whether I use HTTP or HTTPS, they could infer that I'm interested in visiting the resta…

    > Even if I used HTTPS, someone spying on my traffic would 
    > know what I'm reading, if the IP address is a dedicated
    > server for that web site only
How would they know the IP is a dedicated server for that website only, rather than simply a default?

Re: Deprecating Non-Secure HTTP

#80

Post by peteretep »

rogerbinns wrote: post #70
KeytarHero wrote: post #65

Can someone explain why HTTPS is necessary for a webpage where I don't log in or submit any information? For example, take the xkcd homepage. Not only do I not log into it, there's nowhere I _could_ log in. The only input is a search box (which seems to be disabled at the moment anyway). Is it really a security risk if my communication with xkcd's servers is unencrypted? (Yes, xkcd has a store and a forum, and I unde…

Intermediaries can (and already do) silently cause the content to be tracked, altered or otherwise modified against both your and the site owner's interests. How would you feel if they inserted javascript to mine bitcoins?

    > How would you feel if they inserted javascript to mine bitcoins?
I couldn't care less. JavaScript to DDoS GitHub, on the other hand...
Post reply on HN