Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deprecating Non-Secure HTTP

blog.mozilla.org

Post reply on HN
Print view View original

91–100 of 318 posts

Re: Deprecating Non-Secure HTTP

#91

Post by teraflop »

jsn wrote: post #71

I envy you, citizens of the free world :) You (mostly) can use HTTPS, avoid government surveillance, and use new shiny Mozilla features (for whatever they are going to be). It's not the same in e.g. Russia (and I'm sure it's not just Russia). In Russia, the Web is now officially being censored by the state. They have a national register of prohibited resources -- basically, a huge list of URLs. Every ISP must block a…

If you want your ISP to be able to intercept your traffic and see which URLs you're accessing, you could always let them install their own CA certificate on your machine. Then they could proxy and filter to their heart's desire, even over HTTPS.

(only half-joking...)

Re: Deprecating Non-Secure HTTP

#92

Post by deathanatos »

beeworker wrote: post #76
UnoriginalGuy wrote: post #7

I agree with trying to phase out HTTP, but I think their method is "annoying." What do features have to do with HTTP Vs. HTTPS? It just seems like an arbitrary punishment. Wouldn't it just be significantly easier to simply change the URL art style to make clear that HTTP is "insecure." Like a red broken padlock on every HTTP page? That has the following advantages: - HTTP remains fully working for internal/developmen…

While we're making art style changes, why don't we change the experience for self-signed certs? When the user first visits an HTTPS page with a self-signed cert, they get the content, and the URL art style has a broken lock or something warning it's not known to be secure. (It's better than raw HTTP but it's not trusted.) With certificate pinning by the browser, the next time the user visits that page, if it's differ…

> When the user first visits an HTTPS page with a self-signed cert, they get the content, and the URL art style has a broken lock or something warning it's not known to be secure.

Do we assume the user is going to notice that URL art style, and actually heed it? Because if the answer is "no" (and I think in reality, the answer would be "no"), then pick a high value site, and MitM it with a self-signed cert. The user misses the indicator, and proceeds to interact with the site; does JS work? (let's steal the user's cookies) do forms work? (please log in!)

Re: Deprecating Non-Secure HTTP

#93

Post by [deleted] »

teraflop wrote: post #81
cdnsteve wrote: post #56

I have to say, I actually disagree with this move. While I think the intentions sound noble, and I'm all for a more secure web, I also believe that a web browser has no business dictating that the entire web should be forced in HTTPs. I don't see any benefit in this type of blanket, all or nothing, type of approach. In fact, I see it doing more damage than good. Encrypting blogs, news websites, etc still makes no sen…

HTTPS provides authentication, not just confidentiality. When you visit "blogs, news websites, etc" do you think there's no value in being able to know for sure that the content is exactly what the owner of the site intended? Even though ISPs have proven themselves willing to intercept and modify that content in transit? http://arstechnica.com/tech-policy/2013/04/07/how-a-banner-a... http://arstechnica.com/tech-polic…

[deleted]

Re: Deprecating Non-Secure HTTP

#94

Post by vitno »

nothrabannosir wrote: post #38
bigdubs wrote: post #24

Earlier quoted context omitted.

Why this project: https://letsencrypt.org/ is so important. From the site: Let’s Encrypt is a new Certificate Authority: It’s free, automated, and open. Arriving Mid-2015

That's just one project, and it doesn't even exist yet. The web is moving faster every day, apparently. I sure do hope that project will be all it's chalked up to be. For example, I need IP-only certs for a new project I'm working on (waiting for DNS to propagate to all clients is too unreliable and slow). If letsencrypt doesn't do that... well then I'd have to hope real hard for a competent CA out there who has an a…

Let's Encrypt does exist.

I watched a demo where they went from a vanilla apache install to an A scoring HTTPS site in sub 5 minutes at Libreplanet. It's a good idea to publicize the upcoming LARGE change.

Re: Deprecating Non-Secure HTTP

#95

Post by [deleted] »

NeutronBoy wrote: post #78
[deleted] wrote: post #74

[deleted]

Thank god we have technology to serve multiple SSL sites on the same IP! And yes, while SNI isn't supported on older platforms (namely XP and Android 2.x), those platforms are out of support anyway. Part of this push is for security - people on those platforms won't be any worse off anyway (except for getting warning messages).

[deleted]

Re: Deprecating Non-Secure HTTP

#96

Post by nirvdrum »

joelrunyon wrote: post #73
adventured wrote: post #37

Earlier quoted context omitted.

SSL should be a universally available free resource. I expect that it will be in the near future. That said, it is still very cheap for small sites too: $9 - $11 / year for perfectly good certs. Less than $1 per month is a small burden. https://www.namecheap.com/security/ssl-certificates/domain-v...

but you have to get a dedicated IP as well, which means you can host less sites on a small server - something bad for smaller biz.

All modern browsers support SNI [1]. I guess if you need to support IE8 on WinXP you'll have problems. And IIRC, wget on Ubuntu 12.04 doesn't support it (while curl does). But it's picked up a lot in recent years, which thankfully eases the dedicated IP requirement in many cases.

[1] -- http://en.wikipedia.org/wiki/Server_Name_Indication

Re: Deprecating Non-Secure HTTP

#97

Post by whyenot »

adventured wrote: post #37
joelrunyon wrote: post #23

Earlier quoted context omitted.

Seriously, SSLs basically 2x the hosting cost for low end hosting packages. Not great for people running small websites.

SSL should be a universally available free resource. I expect that it will be in the near future. That said, it is still very cheap for small sites too: $9 - $11 / year for perfectly good certs. Less than $1 per month is a small burden. https://www.namecheap.com/security/ssl-certificates/domain-v...

"hosting package" =/= "cert[ificate]"

Re: Deprecating Non-Secure HTTP

#98

Post by to3m »

teraflop wrote: post #41
unethical_ban wrote: post #32

Earlier quoted context omitted.

The actions Mozilla proposes sound awful. I believe that a secure (from the NSA) Internet is the way forward. But this seems so goofy to me. There are legitimate reasons for a site not to be hosted on HTTPS. * It is a static site with no forms or logins * It is non-critical info * The site operator can't afford a certificate (Let's Encrypt is only one site...) As you say: Color-code sites with a bit more granularity.…

What part of this proposal made it seem like static sites with non-critical info would be "crippled" over HTTP?

Static sites or non-critical info! "Gradually phasing out access to browser features for non-secure websites, especially features that pose risks to users’ security and privacy" could affect sites that don't expose critical info.

Re: Deprecating Non-Secure HTTP

#99

Post by diafygi »

Here's two relevant Bugzilla bugs:

Self-signed certificates are treated as errors: https://bugzilla.mozilla.org/show_bug.cgi?id=431386

Switch generic icon to negative feedback for non-https sites: https://bugzilla.mozilla.org/show_bug.cgi?id=1041087

Here's a proposed way of phasing this plan in over time:

1. Mid-2015: Start treating self signed certificates as unencrypted connections (i.e. stop showing a warning, but the UI would just show the globe icon, not the lock icon). This would allow website owners to choose to block passive surveillance without causing any cost to them or any problems for their users.

2. Late-2015: Switch the globe icon for http sites to a gray unlocked lock. The self signed certs would still be the globe icon. The would incentivize website owners to at least start blocking passive surveillance if they want to keep the same user experience as previous. Also, this new icon wouldn't be loud or intrusive to the user.

3. Late-2016: Change the unlocked icon for http sites to a yellow icon. Hopefully, by the end of 2016, Let's Encrypt has taken off and has a lot of frameworks like wordpress including tutorials on how to use it. This increased uptake of free authenticated https, plus the ability to still use self-signed certs for unauthenticated https (remember, this still blocks passive adversaries), would allow website owners enough alternative options to start switching to https. The yellow icon would push most over the edge.

4. Late-2017: Switch the unlocked icon for http to red. After a year of yellow, most websites should already have switched to https (authenticated or self-signed), so now it's time to drive the nail in the coffin and kill http on any production site with a red icon.

5. Late-2018: Show a warning for http sites. This experience would be similar to the self-signed cert experience now, where users have to manually choose to continue. Developers building websites would still be able to choose to continue to load their dev sites, but no production website would in their right mind choose to use http only.

Re: Deprecating Non-Secure HTTP

#100

Post by singlow »

joelrunyon wrote: post #73
adventured wrote: post #37

Earlier quoted context omitted.

SSL should be a universally available free resource. I expect that it will be in the near future. That said, it is still very cheap for small sites too: $9 - $11 / year for perfectly good certs. Less than $1 per month is a small burden. https://www.namecheap.com/security/ssl-certificates/domain-v...

but you have to get a dedicated IP as well, which means you can host less sites on a small server - something bad for smaller biz.

Absolutely no need for a dedicated IP unless you want to support very old versions of Windows or very old versions of Android. I haven't allocated a dedicated IP solely for SSL in years.
Post reply on HN