Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS by default

security.googleblog.com

Post reply on HN
Print view View original

91–100 of 268 posts

Re: HTTPS by default

#91

Post by ottah »

Mmmm, great that and mandatory key rotation every 90 days, plus needing to get a cert from an approved CA, means just that more busy work to have an independent web presence.

I don't like people externalizing their security policy preferences. Yes this might be more secure for a class of use-cases, but I as a user should be allowed to decide my threat model. It's not like these initiatives really solve the risks posed by bad actors. We have so much compliance theater around email, and we still have exactly the same threats and issues as existed twenty years ago.

Re: HTTPS by default

#92

Post by tracker1 »

cube00 wrote: post #76
Ajedi32 wrote: post #20

Earlier quoted context omitted.

Do you depend on a DNS root server to map your website name to your IP address? That's a third party. There are ways to remove that dependency, but it's going to involve a decentralized DNS replacement like Namecoin or Handshake, many of which include their own built-in alternatives to the CA system too so if "no third parties" is something you truly care about you can probably kill two birds with one stone here.

Registrar is the big one, if yours decides to do a Google and randomly ban you and automatically decline your appeal with AI, you're stuffed.

This is generally my biggest concern. Not that I'm doing anything shady, I've wanted to setup a potentially politically charged site in the past.

Re: HTTPS by default

#93

Post by hulitu »

giancarlostoro wrote: post #65
marginalia_nu wrote: post #17

http://www.slackware.com/ is probably the biggest website I'm aware of that does not serve encrypted traffic[1]. but there are a few other legitimately useful resources that don't encrypt. [1] (Except on the arm subdomain for some reason)

My first distro was Slackware. Good memories. The ARM subdomain looks drastically more maintained, posts from 2025. Don't ever view source on slackware.com

> Don't ever view source on slackware.com

why ?

Re: HTTPS by default

#94

Post by AndrewStephens »

sam_lowry_ wrote: post #55
kaoD wrote: post #40

Earlier quoted context omitted.

Just because you don't care doesn't mean nobody cares. I don't want anyone snooping on what I browse regardless of how "safe" someone thinks it is. My navigation habits are boring but they are mine , not anyone else's to see. A server has no way to know whether the user cares or not, so they are not in a position to choose the user's privacy preferences. Also: a page might be fully static, but I wouldn't want $GOVERN…

So... do you refuse to use the laptop supplied by your employer? It does MITM between you and the HTTPS websites you browse.

This is still not that common but I used to work on a commercial web proxy that did exactly this. The only way it works is if the company pushes out a new root certificate via group policy (or something similar) so that the proxy can re-encrypt the data. Users can tell that this is being done by examining the certificate.

But this is mostly a waste of time, these days companies just install agents on each laptop to monitor activity. If you do not own the machine/network you are using then don’t visit sites hat you don’t want them to see.

Re: HTTPS by default

#95

Post by tracker1 »

cle wrote: post #27
kevstev wrote: post #25

Earlier quoted context omitted.

There are dozens of us I guess that care about this kind of thing. I have never really understood the obsession with https for static content that I don't care if anyone can see I am reading like a blog post. HTTPS should be for things that matter, everything else can, and think should use HTTP when it is not necessary. Depending on yet another third party to provide what is IMHO a luxury should not be required, and…

There are good arguments for it, but it's also not a coincidence that they happen to align with Google's business objectives. Ex it's hard to issue a TLS cert without notifying Google of it.

I don't get your logic/reasoning here... could you explain?

Re: HTTPS by default

#96

Post by tracker1 »

kaoD wrote: post #58
sam_lowry_ wrote: post #55

Earlier quoted context omitted.

So... do you refuse to use the laptop supplied by your employer? It does MITM between you and the HTTPS websites you browse.

It doesn't MITM anything. Do you see that as normal? Because I don't. We're adults here and I'm a tech guy, there's zero reason to control anything in my laptop. In fact it's just a regular laptop that I fully control and installed from scratch, straight out of Apple's store. As all my company laptops have been. And if it was company policy I would refuse indeed. I would probably not work there in the first place, hu…

My work laptop has a CA from the organization installed and all HTTP(S) traffic is passed through a proxy server which filters all traffic and self-signs all domains with its' CA. It's relatively common for larger organizations. I've seen this in govt and banking.

Re: HTTPS by default

#97

Post by kaoD »

tracker1 wrote: post #96
kaoD wrote: post #58

Earlier quoted context omitted.

It doesn't MITM anything. Do you see that as normal? Because I don't. We're adults here and I'm a tech guy, there's zero reason to control anything in my laptop. In fact it's just a regular laptop that I fully control and installed from scratch, straight out of Apple's store. As all my company laptops have been. And if it was company policy I would refuse indeed. I would probably not work there in the first place, hu…

My work laptop has a CA from the organization installed and all HTTP(S) traffic is passed through a proxy server which filters all traffic and self-signs all domains with its' CA. It's relatively common for larger organizations. I've seen this in govt and banking.

I know it's common, but I don't think it's "normal" even if it has been "normalized". I wouldn't subject myself to that. If my employer doesn't trust me to act like an adult I don't think it's the place for me.

I could maybe understand it for non-tech people (virus scanning yadda yadda) but for a tech person it's a nuisance at best.

Re: HTTPS by default

#98

Post by [deleted] »

sam_lowry_ wrote: post #12
tialaramex wrote: post #7

I have had HTTPS-by-default for years and I can say that we're past the point where there's noticeable year-to-year change for which sites aren't HTTPS. It's almost always old stuff that pre-dates Let's Encrypt (and presumably just nobody ever added HTTPS). The news site which stopped updating in 2007, the blog somebody last posted to in 2011, that sort of thing. I think it's important to emphasise that although Tim'…

I run my blog in unencrypted HTTP/1.1 just to make a point that we do not have to depend on third parties to publish content online. And I noticed that Whatsapp is even worse than Chrome, it opens HTTPS even if I share HTTP links.

[deleted]

Re: HTTPS by default

#99

Post by bigfatkitten »

kstrauser wrote: post #64
ndriscoll wrote: post #53

Earlier quoted context omitted.

You can already see what site someone visits with HTTPS. It's in the Client Hello, and is important for things like L4 load balancing (e.g. HAProxy can look at the host to choose what backend to forward the TCP packets for that connection to without terminating TLS). It's also important for network operators (e.g. you at home) to be able to filter unwanted traffic (e.g. Google's).

I don't think seeing the site is too important, although there are TLS extensions to encrypt that, too[0]. In practice, a huge chunk of sites still have unique IPs, so seeing that someone is connecting to 1.2.3.4 gives you a pretty good idea of what site they're visiting. That's even easier if they're using plaintext DNS (i.e. instead of DoH) so that you can correlate "dig -t a example.com => 1.2.3.4" followed immedi…

The CIA’s website was a very early adopter of HTTPS across the board, for this very reason.

Most of the site hosted general information about the agency and its functions, but they also had a section where you could provide information.

Re: HTTPS by default

#100

Post by kstrauser »

bigfatkitten wrote: post #99
kstrauser wrote: post #64

Earlier quoted context omitted.

I don't think seeing the site is too important, although there are TLS extensions to encrypt that, too[0]. In practice, a huge chunk of sites still have unique IPs, so seeing that someone is connecting to 1.2.3.4 gives you a pretty good idea of what site they're visiting. That's even easier if they're using plaintext DNS (i.e. instead of DoH) so that you can correlate "dig -t a example.com => 1.2.3.4" followed immedi…

The CIA’s website was a very early adopter of HTTPS across the board, for this very reason. Most of the site hosted general information about the agency and its functions, but they also had a section where you could provide information.

Great point, and an excellent illustration. If it was trivial for an adversary to see that some people were visiting http://cia.gov/visitor-center-and-gift-shop-hours, but others were visiting https://cia.gov/[we-can't-see-this-part], they'd know exactly who to concentrate their rubber hose cryptography efforts on.
Post reply on HN