Still Why No HTTPS? • Hacker News Board

Re: Still Why No HTTPS?

#81

Post by tyingq » Tue, Dec 17, 2019, 11:40 AM UTC

founderling wrote: post #70

Because there is only one free certificate provider (lets encrypt) and it does not allow wildcard certificates via server authentification. Having the DNS credentials laying around on the server is not a good idea. So creating wildcard certs via letsencrypt is a huge pain in the ass. If a webmaster has control over somedomain.com I think that is enough to assume he has control over *.somedomain.com. So I think letsen…

Maybe you saw this, but you can make _acme-challenge.domainA.tld a CNAME to _acme-challenge.domainB.tld. Where domainB is a throwaway domain used only for validation. There are some TLDs that are pretty cheap per year.

Re: Still Why No HTTPS?

#82

Post by majewsky » Tue, Dec 17, 2019, 11:40 AM UTC

cesarb wrote: post #46

WilliamEdward wrote: post #4

Some websites adamantly insist they did not need HTTPS because they are purely static. https://www.troyhunt.com/heres-why-your-static-website-needs... The same website to my surprise has an article on why this is faulty reasoning.

Though I'm on the "encrypt all the things!" camp, let me play devil's advocate for a moment. If I set up a purely static HTTP-only site in 1998, it would still work with today's browsers, more than 20 years later. If I set up a purely static HTTPS-only site in 1998, and didn't follow the upgrade treadmill, it would have stopped working for modern browsers some time ago.

Even with a static HTTP-only website, there's tons of stuff that you have to update anyway. Hardware gets outdated and needs replacing, at which point you cannot postpone the kernel update anymore because you need the new device drivers, etc. etc. You also don't want to stop updating your HTTP server, CVEs get discovered quite frequently. You can of course draw a line between that churn and the churn of updating your TLS config every few years, but it's more arbitrary than you think.

Re: Still Why No HTTPS?

#83

Post by squiggleblaz » Tue, Dec 17, 2019, 11:40 AM UTC

dx034 wrote: post #53

jwr wrote: post #26

Earlier quoted context omitted.

It is relatively straightforward if you have a single site hosted on a well-supported operating system and web server. It suddenly becomes really, really complicated if you have multiple servers, multiple domains, nginx configurations that the tool does not expect (but insists on rewriting).

The rewrite is optional, it's also fairly trivial to let certbot create certificates and adapt nginx afterwards.

Yes, but at that point it's not two lines with let's encrypt any more.

For my part, I had to write around a thousand lines of script and alter various existing code in order to switch from manual ssl (whenever the client paid for it) to automatic ssl (everywhere), because there was no way I was going to manually buy hundreds of certificates a year when I took over this role. Nowadays we're 100% ssl but it was harder for an existing person already accustomed to the existing system than doing nothing. I'm just too lazy to check a site every week and renew many certificates manually and copy around stupid files and generally go crazy. Plus, if it's automated, I think there's less chance of the keys being copied. So in my mind it was worth the effort, but it was surely effort.

Re: Still Why No HTTPS?

#84

Post by founderling » Tue, Dec 17, 2019, 11:41 AM UTC

dijit wrote: post #75

I have a reason not to use https. I host a single site on a host (so, no login, subject name or path information to leak), which only contains details how to connect to my irc server at the same address. If the message is altered then the most pain anyone will have is connecting somewhere else for the first time. (They won’t be automatically logging in if they’re using this page). Why does everything need to be TLS?…

    If the message is altered then the most pain
    anyone will have is connecting somewhere else
    for the first time

If the page is altered so it loads 3rd party tracking code, then the pain is to be tracked.

If the page is altered so it opens a "Please enter your ebay login" phishing site in the background, a user might switch tabs, think "Oh, I logged out of ebay somehow" and enter their password into the attackers site. Exposing them to the pain of ecommerce fraud.

If the page is altered to use a 0-day exploit, the pain is to have a zombie machine afterwards.

Etc etc ...

Re: Still Why No HTTPS?

#85

Post by tyingq » Tue, Dec 17, 2019, 11:41 AM UTC

benjojo12 wrote: post #74

founderling wrote: post #72

Earlier quoted context omitted.

Did you miss the "free" in my comment or am I missing something?

To quote the link in my reply to you: > Buypass Go SSL > It is free! Issued in Scandinavia based on the industry standard ACME. I posted a diff showing the patch you can use to switch go's crypto/acme/autocert to use it. The CA does sell paid SSL product, but they also have a free ACME endpoint that issues 6 month certs. Here is an example of what one of the certs look like: https://crt.sh/?id=2075589060

The wildcart cert from them isn't free, or even inexpensive.

Re: Still Why No HTTPS?

#86

Post by majewsky » Tue, Dec 17, 2019, 11:41 AM UTC

pcmonk wrote: post #35

iudqnolq wrote: post #22

Earlier quoted context omitted.

Our asshat twin n-gate has something to say about this > Horseshit. Users must keep themselves safe. Software can't ever do that for you. Users are on their own to ensure they use a quality web client, on a computer they're reasonably sure is well-maintained, over an internet connection that is not run by people who hate them. None of the packets I send out are unsafe, so my site does not need HTTPS. > None of those…

Can't read the article because the captcha won't load, but this reply doesn't make any sense. What can the browsers do without the cooperation of the server? You don't really need encryption to deal with that specific problem, but you do need signatures, which means you need a certificate anyway. It's quite a strange attitude toward the problem.

The captcha is because you come with a Referer of news.ycombinator.com. Try opening the website in Private Mode.

Re: Still Why No HTTPS?

#87

Post by majewsky » Tue, Dec 17, 2019, 11:42 AM UTC

iudqnolq wrote: post #22

WilliamEdward wrote: post #4

Some websites adamantly insist they did not need HTTPS because they are purely static. https://www.troyhunt.com/heres-why-your-static-website-needs... The same website to my surprise has an article on why this is faulty reasoning.

Our asshat twin n-gate has something to say about this > Horseshit. Users must keep themselves safe. Software can't ever do that for you. Users are on their own to ensure they use a quality web client, on a computer they're reasonably sure is well-maintained, over an internet connection that is not run by people who hate them. None of the packets I send out are unsafe, so my site does not need HTTPS. > None of those…

> If people don't want to see my site with random trash inserted into it, they can choose not to access it through broken and/or compromised networks.

While I like n-gate's no-bullshit attitude, he seriously needs to check his privileges.

Re: Still Why No HTTPS?

#88

Post by founderling » Tue, Dec 17, 2019, 11:44 AM UTC

benjojo12 wrote: post #74

founderling wrote: post #72

Earlier quoted context omitted.

Did you miss the "free" in my comment or am I missing something?

To quote the link in my reply to you: > Buypass Go SSL > It is free! Issued in Scandinavia based on the industry standard ACME. I posted a diff showing the patch you can use to switch go's crypto/acme/autocert to use it. The CA does sell paid SSL product, but they also have a free ACME endpoint that issues 6 month certs. Here is an example of what one of the certs look like: https://crt.sh/?id=2075589060

    It is free!

Something might be free there. But not the wildcard certs we are talking about.

Re: Still Why No HTTPS?

#89

Post by founderling » Tue, Dec 17, 2019, 11:46 AM UTC

tyingq wrote: post #81

founderling wrote: post #70

Because there is only one free certificate provider (lets encrypt) and it does not allow wildcard certificates via server authentification. Having the DNS credentials laying around on the server is not a good idea. So creating wildcard certs via letsencrypt is a huge pain in the ass. If a webmaster has control over somedomain.com I think that is enough to assume he has control over *.somedomain.com. So I think letsen…

Maybe you saw this, but you can make _acme-challenge.domainA.tld a CNAME to _acme-challenge.domainB.tld. Where domainB is a throwaway domain used only for validation. There are some TLDs that are pretty cheap per year.

That might be a step forward. Still a bit complex, but maybe worth considering.

Would that work for mulitple domains? So I CNAME the _acme-challenge subdomain for all my domains to _acme-challenge.cheapthrowaway.com?

Re: Still Why No HTTPS?

#90

Post by throw0101a » Tue, Dec 17, 2019, 11:48 AM UTC

dijit wrote: post #75

I have a reason not to use https. I host a single site on a host (so, no login, subject name or path information to leak), which only contains details how to connect to my irc server at the same address. If the message is altered then the most pain anyone will have is connecting somewhere else for the first time. (They won’t be automatically logging in if they’re using this page). Why does everything need to be TLS?…

> Why does everything need to be TLS? It feels like a cargo cult. A requirement: “because!”

Traditionally, people have only encrypted things that are deemed sensitive (logins, money, health). However, when the majority of traffic is non-encrypted, actually ciphered data is very noticeable to anyone monitoring the network, and it screams "look at me! I am important!".

However, when >90% of traffic of the Internet is encrypted, then there is no 'extra' information to be gained from that fact. If further forces any surveillance program to expend extra resources to either trying decrypting everything, or choose to only focus on those people that it actually deems important, instead of wholesale surveillance of the entire population.

Further, encrypting content prevents it from being modified, reducing your potential to be leverage against:

> The Great Cannon of China is an Internet attack tool that is used to launch distributed denial-of-service attacks on websites by performing a man-in-the-middle attack on large amounts of web traffic and injecting code which causes the end-user's web browsers to flood traffic to targeted websites.[1]

* https://en.wikipedia.org/wiki/Great_Cannon

* https://citizenlab.ca/2015/04/chinas-great-cannon/