7 ms·

Kudos to the Let's Encrypt and Wordpress teams. This is what the future looks like. Every webpage needs to be encrypted, and http (as opposed to https) needs to

Kudos to the Let's Encrypt and Wordpress teams. This is what the future looks like. Every webpage needs to be encrypted, and http (as opposed to https) needs to go the way of telnet (as compared to ssh). What's particularly great is that there is no configuration of any kind for Wordpress authors or their readers. Like they have done, we need to always default to secure.

geostyx 11y ago
I still see login pages over http sometimes. I will be happy when I rarely see any http pages. I wonder what would happen if Chrome made all http pages red to indicate insecure...
- Sidnicious 11y ago
  They plan to: https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure https://www.chromium.org/Home/chromium-security/marking-http...
- colinbartlett 11y ago
  There's a Chrome flag you can enable for that experience today, as it's only a matter of time before that is default. I use this and so this is how the TechCrunch article shows for me: http://i.imgur.com/c8Cz7S4.png http://i.imgur.com/c8Cz7S4.png
  - pointytrees 11y ago
    And, that imgur link is also a broken lock? ;)
- inglor 11y ago
  Just the fact http was the default for all websites hosted on WordPress.com is really weird to me. All those websites had all the passwords sent over plaintext.
  - pfg 11y ago
    Note that this is about custom domains hosted on Wordpress.com's infrastructure. Blogs that were hosted as subdomains of wordpress.com have been using SSL since 2014 according to the original announcement. Let's Encrypt allowed them to enable it for custom domains without delivering a truckload of money to a CA. The original announcement is a bit more precise on this.
  - pmaiorana 11y ago
    Nope — login pages have been https for many years.
  - tajen 11y ago
    That's because Google rewards on page speed, and SSL used to make you lose the game. So if you want your wordpress to be well referenced, it used to be better to have it insecure. Additionnaly if you published both on HTTP and HTTPS, you were flagged as duplicate content. Fortunately they've reordered the incentives now.
- michaelbuckbee 11y ago
  Mozilla has it in dev - https://hacks.mozilla.org/2016/01/login-forms-over-https-please/ https://hacks.mozilla.org/2016/01/login-forms-over-https-ple...
  - cpeterso 11y ago
    That blog post is from January and Firefox Dev Edition 46 has since advanced to Beta. The insecure login warning will ship to the Firefox release channel on April 26. :)
sargas 11y ago
> we need to always default to secure. This.
afarrell 11y ago
There should still exist one well-known unencrypted page. Sometimes, I need to log in to hotel or airport wifi and therefore need to accept a MitM attack. I would prefer this not to be the case.
- knodi123 11y ago
  What would one well-known unencrypted page do to mitigate that?
  - megablast 11y ago
    If you go to a http page, and haven't logged it, it will redirect you to the login page. If you try that over https, it just fails.
    - knodi123 11y ago
      Oh, now I feel dumb, I thought this was a security comment and not a practical one. Thanks for clarifying.
- iainnash 11y ago
  http://example.com/ http://example.com/ perhaps?
  - afarrell 11y ago
    I use http://xkcd.com http://xkcd.com, but that works.
- deleted 11y ago
  [deleted]
- eric-hu 11y ago
  Apple products use this one for hotspot detection: http://captive.apple.com/hotspot-detect.html http://captive.apple.com/hotspot-detect.html I just have it bookmarked now. It's the one bookmark I use.
melvinmt 11y ago
Of course techcrunch.com itself still does not support HTTPS.
- Viper007Bond 11y ago
  They're an enterprise customer and not automatically enrolled into this for a few reasons. See https://news.ycombinator.com/item?id=11459229 https://news.ycombinator.com/item?id=11459229
Bahamut 11y ago
I'm speaking out of ignorance here, but why does every webpage need to be encrypted? What about simple static sites that are only serving information?
- ams6110 11y ago
  So that you have assurance that you're connecting to the site you intended to, and not an imposter, and so you know that the information has not been altered in transit.
  - beefhash 11y ago
    Not only that the high-level information on the page has not been altered, but also just simply that no code has been injected that could possibly lead to a drive-by download or other malware shenanigans.
- tajen 11y ago
  1. Comcast (the US ISP) inserts advertising in http webpages, to the point that it breaks webpages, delivers malicious content, or replaces a 404 with a "Do you want to download [that IE toolbar/Chrome extension which inserts ads in every page]". ISP are extremely bad-behaved. This is active spamming. 2. Hey Joe, I've seen you've consulted wikipedia pages about unionizing. What about we give you plenty of free time to unionize yourself? 2. Have you ever downloaded the pic of a sexualized person? Do you have his/her ID card on file? If not, does she "look like" <18 years old? I don't mean is she actually, but what would a jury of average blokes (who neither care about truth and want to have the trial over soon) vote for if they had to vote? Boom, you're jailed as a child pornographer, even though the model was professional and over 25. That's the beauty of blackmail. This could happen as soon as you have professional secrets, or you are annoying for a competitor or a colleague, so as soon as you do anything meaningful in this world.
  - ksec 11y ago
    Are there any other method to prevent / protect information being hijacked without going for encrypt?
developer2 11y ago
The one thing a lot of people don't consider is that placing an entire site on https/ssl/tls ruins the traditional approach to caching. It used to be very simple to add a full-page caching layer in front of your unencrypted application. TLS completely destroys this. You can no longer simply plop a proxy cache in front of your application. There are numerous approaches to make tls-for-all work, but they take more engineering effort. And some introduce security problems, like people who use CloudFlare which decrypts your traffic and then (optionally!!!) re-encrypts it between their servers and yours. Even taking the best encryption scheme with a CDN like CloudFlare still means that the CDN has full access to unencrypted payloads. That is an insane amount of trust to give away to a 3rd party company. There is also an impact for large organizations that run everything through a local cache (like Squid). You can't share a cache between multiple clients when TLS is used. This push to encrypt everything means we're at the end of the era where such caches are useful. Does BuzzFeed really need to be encrypted? One of the largest gaps in encryption in general is still performance. You hear all the time how TLS adds almost zero overhead anymore. This is simply false for most of us. Not everyone is Google who has their own custom low-level encryption implementation. Those of us using off-the-shelf software continue to pay the price of CPU overhead.
- pfg 11y ago
  > It used to be very simple to add a full-page caching layer in front of your unencrypted application. TLS completely destroys this. You can no longer simply plop a proxy cache in front of your application. I wouldn't say it's no longer possible. You have to do your caching before the TLS termination, and you'll have to pay the encryption overhead for every resource. > This push to encrypt everything means we're at the end of the era where such caches are useful. You can still do this kind of caching if you install your own CA certificate on all your devices. Almost all enterprise deployments will do this anyway so that their security appliances can scan TLS traffic. Squid supports this. > Does BuzzFeed really need to be encrypted? Yep! Otherwise, that free WiFi at your favourite cafe, or your ISP, might inject malicious code or ads. > You hear all the time how TLS adds almost zero overhead anymore. This is simply false for most of us. Not everyone is Google who has their own custom low-level encryption implementation. Those of us using off-the-shelf software continue to pay the price of CPU overhead. Obligatory reference to https://istlsfastyet.com/ https://istlsfastyet.com/ There are two aspects here: Handshakes and encryption performance. Handshakes are expensive, you can probably do about 500-1k handshakes per core per second with a 2048 bit RSA key. This is usually no big deal in production because you can use session resumption, meaning once you've completed a handshake with a user, you can skip that part until the cache expires (people tend to use one day as their lifetime). The second aspect, raw encryption performance with a symmetric cipher, is something you don't get to complain about unless you're Netflix. Any server CPU with AES-NI can push at least 500MB/s per core per second, probably more. You'll run into some other bottleneck way before TLS performance becomes an issue. Unless you're Netflix, of course[1]. [1]: https://people.freebsd.org/~rrs/asiabsd_2015_tls.pdf https://people.freebsd.org/~rrs/asiabsd_2015_tls.pdf
niutech 11y ago
Don't forget about loads of websites on cheap shared hosting, which cannot use Let's Encrypt or other free SSL certificates. And Telnet, used for logging in to a server, is much more dangerous than plain HTTP, used just for viewing HTML documents.
- Matt3o12_ 11y ago
  some cheap hosting providers started enabling SSL by default for all their users who use a subdomain (e.g. User.cheaphosting.tld) and mine just announced that they provide free SSL certificates for all custom domains by default thanks to letsencrypt.
  - emdd 11y ago
    Good to know! Can you share which one you are speaking of?
    - Matt3o12_ 11y ago
      I thought of Lima city, but they are a German hoster (website is in German, data centers are in Frankfort, Germany). I'm sure you will be able to find many others. Lima city is free (as in beer) and have unlimited storage[1], unlimited bandwidth, support PHP and MySQL, and allow you to add custom domains (you can buy them directly though them for very reasonable prices). Although they are free, they have very little outages but they area limited to PHP (a big no-go for all my projects these days). Disclaimer: I'm in no way affiliated with them except hosting my homepage there. I've used them for quite a few years now and they allowed me to show off my PHP projects to friends when I was 14 or so. [1]: they have a fair use policy and downloads (everything except, html, PHP, css, js, and image files) are blocked and need to be hosted on their download server, which has a rate limit. They will also monitor your account for abuse (so if you consume a lot of bandwidth because you hid your download in the JPG file, they will ban you).
- nsgi 11y ago
  Many cheap hosts are adding support for Let's Encrypt. This story is a prime example.

geostyx 11y ago

I still see login pages over http sometimes. I will be happy when I rarely see any http pages. I wonder what would happen if Chrome made all http pages red to indicate insecure...

Sidnicious 11y ago
They plan to: https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure https://www.chromium.org/Home/chromium-security/marking-http...
colinbartlett 11y ago
There's a Chrome flag you can enable for that experience today, as it's only a matter of time before that is default. I use this and so this is how the TechCrunch article shows for me: http://i.imgur.com/c8Cz7S4.png http://i.imgur.com/c8Cz7S4.png
- pointytrees 11y ago
  And, that imgur link is also a broken lock? ;)
inglor 11y ago
Just the fact http was the default for all websites hosted on WordPress.com is really weird to me. All those websites had all the passwords sent over plaintext.
- pfg 11y ago
  Note that this is about custom domains hosted on Wordpress.com's infrastructure. Blogs that were hosted as subdomains of wordpress.com have been using SSL since 2014 according to the original announcement. Let's Encrypt allowed them to enable it for custom domains without delivering a truckload of money to a CA. The original announcement is a bit more precise on this.
- pmaiorana 11y ago
  Nope — login pages have been https for many years.
- tajen 11y ago
  That's because Google rewards on page speed, and SSL used to make you lose the game. So if you want your wordpress to be well referenced, it used to be better to have it insecure. Additionnaly if you published both on HTTP and HTTPS, you were flagged as duplicate content. Fortunately they've reordered the incentives now.
michaelbuckbee 11y ago
Mozilla has it in dev - https://hacks.mozilla.org/2016/01/login-forms-over-https-please/ https://hacks.mozilla.org/2016/01/login-forms-over-https-ple...
- cpeterso 11y ago
  That blog post is from January and Firefox Dev Edition 46 has since advanced to Beta. The insecure login warning will ship to the Firefox release channel on April 26. :)

sargas 11y ago

> we need to always default to secure. This.

afarrell 11y ago

There should still exist one well-known unencrypted page. Sometimes, I need to log in to hotel or airport wifi and therefore need to accept a MitM attack. I would prefer this not to be the case.

knodi123 11y ago
What would one well-known unencrypted page do to mitigate that?
- megablast 11y ago
  If you go to a http page, and haven't logged it, it will redirect you to the login page. If you try that over https, it just fails.
  - knodi123 11y ago
    Oh, now I feel dumb, I thought this was a security comment and not a practical one. Thanks for clarifying.
iainnash 11y ago
http://example.com/ http://example.com/ perhaps?
- afarrell 11y ago
  I use http://xkcd.com http://xkcd.com, but that works.
deleted 11y ago
[deleted]
eric-hu 11y ago
Apple products use this one for hotspot detection: http://captive.apple.com/hotspot-detect.html http://captive.apple.com/hotspot-detect.html I just have it bookmarked now. It's the one bookmark I use.

melvinmt 11y ago

Of course techcrunch.com itself still does not support HTTPS.

Viper007Bond 11y ago
They're an enterprise customer and not automatically enrolled into this for a few reasons. See https://news.ycombinator.com/item?id=11459229 https://news.ycombinator.com/item?id=11459229

Bahamut 11y ago

I'm speaking out of ignorance here, but why does every webpage need to be encrypted? What about simple static sites that are only serving information?

ams6110 11y ago
So that you have assurance that you're connecting to the site you intended to, and not an imposter, and so you know that the information has not been altered in transit.
- beefhash 11y ago
  Not only that the high-level information on the page has not been altered, but also just simply that no code has been injected that could possibly lead to a drive-by download or other malware shenanigans.
tajen 11y ago
1. Comcast (the US ISP) inserts advertising in http webpages, to the point that it breaks webpages, delivers malicious content, or replaces a 404 with a "Do you want to download [that IE toolbar/Chrome extension which inserts ads in every page]". ISP are extremely bad-behaved. This is active spamming. 2. Hey Joe, I've seen you've consulted wikipedia pages about unionizing. What about we give you plenty of free time to unionize yourself? 2. Have you ever downloaded the pic of a sexualized person? Do you have his/her ID card on file? If not, does she "look like" <18 years old? I don't mean is she actually, but what would a jury of average blokes (who neither care about truth and want to have the trial over soon) vote for if they had to vote? Boom, you're jailed as a child pornographer, even though the model was professional and over 25. That's the beauty of blackmail. This could happen as soon as you have professional secrets, or you are annoying for a competitor or a colleague, so as soon as you do anything meaningful in this world.
- ksec 11y ago
  Are there any other method to prevent / protect information being hijacked without going for encrypt?

developer2 11y ago

The one thing a lot of people don't consider is that placing an entire site on https/ssl/tls ruins the traditional approach to caching. It used to be very simple to add a full-page caching layer in front of your unencrypted application. TLS completely destroys this. You can no longer simply plop a proxy cache in front of your application. There are numerous approaches to make tls-for-all work, but they take more engineering effort. And some introduce security problems, like people who use CloudFlare which decrypts your traffic and then (optionally!!!) re-encrypts it between their servers and yours. Even taking the best encryption scheme with a CDN like CloudFlare still means that the CDN has full access to unencrypted payloads. That is an insane amount of trust to give away to a 3rd party company. There is also an impact for large organizations that run everything through a local cache (like Squid). You can't share a cache between multiple clients when TLS is used. This push to encrypt everything means we're at the end of the era where such caches are useful. Does BuzzFeed really need to be encrypted? One of the largest gaps in encryption in general is still performance. You hear all the time how TLS adds almost zero overhead anymore. This is simply false for most of us. Not everyone is Google who has their own custom low-level encryption implementation. Those of us using off-the-shelf software continue to pay the price of CPU overhead.

pfg 11y ago
> It used to be very simple to add a full-page caching layer in front of your unencrypted application. TLS completely destroys this. You can no longer simply plop a proxy cache in front of your application. I wouldn't say it's no longer possible. You have to do your caching before the TLS termination, and you'll have to pay the encryption overhead for every resource. > This push to encrypt everything means we're at the end of the era where such caches are useful. You can still do this kind of caching if you install your own CA certificate on all your devices. Almost all enterprise deployments will do this anyway so that their security appliances can scan TLS traffic. Squid supports this. > Does BuzzFeed really need to be encrypted? Yep! Otherwise, that free WiFi at your favourite cafe, or your ISP, might inject malicious code or ads. > You hear all the time how TLS adds almost zero overhead anymore. This is simply false for most of us. Not everyone is Google who has their own custom low-level encryption implementation. Those of us using off-the-shelf software continue to pay the price of CPU overhead. Obligatory reference to https://istlsfastyet.com/ https://istlsfastyet.com/ There are two aspects here: Handshakes and encryption performance. Handshakes are expensive, you can probably do about 500-1k handshakes per core per second with a 2048 bit RSA key. This is usually no big deal in production because you can use session resumption, meaning once you've completed a handshake with a user, you can skip that part until the cache expires (people tend to use one day as their lifetime). The second aspect, raw encryption performance with a symmetric cipher, is something you don't get to complain about unless you're Netflix. Any server CPU with AES-NI can push at least 500MB/s per core per second, probably more. You'll run into some other bottleneck way before TLS performance becomes an issue. Unless you're Netflix, of course[1]. [1]: https://people.freebsd.org/~rrs/asiabsd_2015_tls.pdf https://people.freebsd.org/~rrs/asiabsd_2015_tls.pdf

niutech 11y ago

Don't forget about loads of websites on cheap shared hosting, which cannot use Let's Encrypt or other free SSL certificates. And Telnet, used for logging in to a server, is much more dangerous than plain HTTP, used just for viewing HTML documents.

Matt3o12_ 11y ago
some cheap hosting providers started enabling SSL by default for all their users who use a subdomain (e.g. User.cheaphosting.tld) and mine just announced that they provide free SSL certificates for all custom domains by default thanks to letsencrypt.
- emdd 11y ago
  Good to know! Can you share which one you are speaking of?
  - Matt3o12_ 11y ago
    I thought of Lima city, but they are a German hoster (website is in German, data centers are in Frankfort, Germany). I'm sure you will be able to find many others. Lima city is free (as in beer) and have unlimited storage[1], unlimited bandwidth, support PHP and MySQL, and allow you to add custom domains (you can buy them directly though them for very reasonable prices). Although they are free, they have very little outages but they area limited to PHP (a big no-go for all my projects these days). Disclaimer: I'm in no way affiliated with them except hosting my homepage there. I've used them for quite a few years now and they allowed me to show off my PHP projects to friends when I was 14 or so. [1]: they have a fair use policy and downloads (everything except, html, PHP, css, js, and image files) are blocked and need to be hosted on their download server, which has a rate limit. They will also monitor your account for abuse (so if you consume a lot of bandwidth because you hid your download in the JPG file, they will ban you).
nsgi 11y ago
Many cheap hosts are adding support for Let's Encrypt. This story is a prime example.