22 ms·
US Senate website says use HTTP instead of HTTPS
- sacheendra 10y agoCan someone tell me why this might have been required? What are the situations which might prompt a developer to make their users use http instead of https?
- gosukiwi 10y agoMoney :p
- nitrogen 10y agoWhat are the situations which might prompt a developer to make their users use http instead of https? Tracking detailed referrer information from social media, etc. I don't agree with this goal, but it is something that's very important to people running sites with significant social traffic.
- Benjamin_Dobell 10y agoCaching. Mind you, I don't know if that's the case here; it certainly doesn't seem like caching should be a large priority for this sort of content.
- blowski 10y agoAt a guess, it was built years ago by an agency selected on the basis of anything other than technical competence. As a result it probably has thousands of hard coded HTTP links and an oddly configured out of date web server. Given the 'encryption is only used by terrorists' climate, spending the time and money to make it work for https sounds like a hard sell. No sources, but I have done some work in UK public sector and that kind of story would match.
- SFJulie 10y agoWell it does the job, and if it aint broken why fix it?
- unepipe 10y agoIt creates an easy vector for MITM attacks - could be done by nefarious parties on US citizens traveling in other countries for example.
- SFJulie 10y agoSo looking who are your senators is putting you at risk? Isn't it a tad paranoid?
- unepipe 10y agoIt creates an easy vector for MITM attacks - could be done by nefarious parties on US citizens traveling in other countries for example.
- shmapf 10y agoJust a wild guess, but if there are non secure assets in the page, this would result in a browser warning, arguably more suspicious looking than this for average users. As a quick and dirty workaround they may have done this?
- akira2501 10y agoInterestingly, some of the subdomains like https://www.budget.senate.gov/ https://www.budget.senate.gov/ use the same certificate and do allow you to load their pages with mixed sources. If this was the idea, it was done fairly shoddy.. more than a few sites in the 'Alternative Name' field will still load.
- retube 10y agoLegacy site/infrastructure that hasn't (or can't) be upgraded?
- acdha 10y agoThink of the government as a particular large, stratified enterprise IT shop with some weighty policy/legal requirements driving some of the internal barriers. I'm imagining that it went something like this: the group which owns the public web servers decides to start using HTTPS and slogs through renegotiating their CDN contract, purchasing and installing an EV certificate, etc. As they go through compatibility testing, someone finds a problem. Maybe that's a bunch of legacy HTML which triggers mixed-content warnings, maybe that's a problem with some creaky old legacy application which expects HTTP and doesn't follow redirects or chokes on modern cipher suites, etc. Since they can no longer say that switching won't break anything, someone pauses the project until they can fix the problems. Maybe someone suggests using a rewriting proxy to fix it but the people who own the server it'd need to run on are worried about performance/security. Maybe the legacy app is something licensed from a vendor who wants $$$ for a major upgrade rather than just making this one change. Maybe that requires a change in next year's budget because they've already allocated all of the money they're legally allowed to spend on that class of work. It could be as simple as budget: they're using Akamai and it's likely that the contract they originally signed didn't include HTTPS, and at least in the past adding it was a non-trivial price increase. I could easily believe that this could be as simple as either a test pending a new contract or that a section of the website (or a subdomain) uses HTTPS but they added a general redirect to avoid paying the higher HTTPS rates for traffic which doesn't require it.
- RijilV 10y agoWeird, they're hosted on Akamai. Even weirder, it doesn't appear that www.senate.gov supports IPv6.
- killbrad 10y agoWhat's weird about them not supporting ipv6?
- RijilV 10y agoWell, briefly - the General Service Administration declared "By September 30, 2014, agencies needed to update their public networks to Internet Protocol Version 6 (IPv6)" There is an exception process, but Akamai already supports IPv6 (though they do charge extra for it, booo!). You'd like to think something as high visibility (PR, not web traffic) as senate.gov would comply with the GSA. http://gsablogs.gsa.gov/technology/2014/01/02/1128/ http://gsablogs.gsa.gov/technology/2014/01/02/1128/
- labster 10y agoThe US Senate is not an agency. They are a branch of Congress, and therefore definitely not required to do anything a executive agency tells them to do -- especially if it's reasonable like implementing HTTPS.
- konklone 10y agoYes, the IPv6 is a White House (not GSA) mandate, like https://https.cio.gov https://https.cio.gov. It doesn't apply to the legislative or judicial branches, and in that blog post, GSA is advertising the services it can offer other agencies to help them achieve IPv6 compliance.
- willvarfar 10y agoWell, if you've got nothing to hide... ;)
- blackhaz 10y agoAnd it's OK. This "HTTPS everywhere" concept is damaging. I think it should be revised. The amount of overhead and the lack of ability to optimize encrypted content for transferring over, say, satellite or other radio links, is bad. Lots of people still use very expensive (>$2,000 per Mbps) long-RTT connections that would benefit immensely from content optimization techniques. And most of them are cost-sensitive because they live in developing countries.
- NhanH 10y agoWouldn't that be a whole new level of "premature optimization"? Serve https by default and also http for those still needs it for the reasons you outline.
- Ueland 10y agoSomething like gzip that "all" browsers and servers support? Which i would belive more than makes up for any https overhead.
- sleepychu 10y agoThey're proposing lossy compression. That'd be a neat feature though, during the negotiation (once your comms are encrypted) you could ask the server to perform lossy compression on certain resources, would save battery life on the mobile client as well!
- Buge 10y agoThat's kind of what mobile sites do. They shrink the size of the site making it simpler and smaller.
- mike-cardwell 10y agoThe trade-off is worth it. By a large margin.
- throwaway16385 10y ago
- demarq 10y agoI also noticed it seems blocked from access outside the US... so what would happen if a traveling american wants to access it? edit: FYI I'm trying from Kenya. edit2: Using my phone I'm able to switch between wifi, and mobile and on mobile it is unblocked. hmmm Also for those who don't see the Access Denied page but are curious, here is what it reads in full. -------------------- Access Denied You don't have permission to access "http://serve-403-www.senate.gov/" http://serve-403-www.senate.gov/" on this server. Reference #xx.xxxxxxxx.xxxxxxxxxx.xxxxxxxx --------------------- It seems it has little to do with geography. It's an IP thing.
- klez 10y agoNope, I'm in Italy and can access it from here.
- aavotins 10y agoNot blocked in the Netherlands, but it opens the https version , which displays the following error: The submitted https request was not able to be completed at this time. Please retry your request using http. This may require disabling some browser based plug-ins. Clicking the provided link causes a redirect loop(i.e. the http version redirects back to https)
- zyx321 10y ago>Clicking the provided link causes a redirect loop Disabling HTTPS-Everywhere fixed that for me.
- raimille1 10y agoExcuse the ignorance, but what's the problem if it's purely an informational read only site? There's no logins, prompts, messaging that can be exploited. What's the problem of it being unencrypted? Don't get me wrong I'm all for https when there's user information to be protected back and forth, I just don't see the applicability for it here.
- MichaelGG 10y agoNo reason for it not to. And certainly I could find some fun uses of changing information for visitors to a .gov site.
- mike-cardwell 10y agoIf you visit any non-https site, then you leave a vector wide open for a MITM to perform numerous types of attacks. Not just against the unencrypted site you're visiting. They can launch phishing attacks or CSRF attacks or inject malware. If every site were https, then that would provide a huge boost to peoples privacy and security.
- formula_ninguna 10y ago>If you visit any non-https site, then you leave a vector wide open for a MITM to perform numerous types of attacks. how?
- mike-cardwell 10y agoI gave 3 examples. Phishing, malware injection and CSRF. If you want to know how these sorts of attacks work, there isn't enough space in a HN comment so go use a search engine.
- inglor 10y agoPhishing and malware injection are obvious - but how would that give you (any more) leverage to perform CSRF? (since well, the backend validates the token). XSS for sure (which is probably what you meant by malware injection) and that sort of can enable CSRF if the vulnerability was already there - but I don't think it can cause it.
- willvarfar 10y agoI wondered if there were any senator contact forms etc but I couldn't find any. However, you can use the 'find your senator' drop-down top-right to find a senator's private website contact form. Those I looked at were all unencrypted too.
- logicallee 10y agoHow strange, I changed it to http as asked. For me it then asked for my social security number to login and then I needed to confirm some of my banking information for the IRS. I'd expect that to be information you'd want to protect!! I actually double checked to make sure I wasn't on a phising site but I was safe: "senate.gov" why did they need my banking information? Oh well. The above is fiction, but an easy scenario under HTTP. Any AP (wifi access point, like at a cafe) can do it...
- jrapdx3 10y agoAttempted to write to one of my senators. To do so online requires using the web form on the senator's "contact" page. It says only messages from the senator's constituents will be accepted, so it's necessary for the author to share some identifying info. I don't know how much checking is done to assure the writer really is a constituent, probably there's some lookup of street addresses, zip codes, etc. Main point is that the senator's contact page does use https. This is appropriate given that personal info is shared per the contact form. I don't think any other senate pages accept input, so maybe their reasoning is that http vs. https is less critical on other parts of the site.
- ohitsdom 10y agoUnderstood, but the contact link could be maliciously changed through a MITM attack (which would be prevented if the whole domain was accessible through HTTPS).
- Reason077 10y agoI'd forgotten how fast everything loads if you use http instead of https. It's quite refreshing to not have that initial half-second or so lag that you get when loading an https page. Hopefully we'll make back some of the difference once http/2 is more widespread.
- witty_username 10y agoWell, for me that's only true for the first time I visit a website. HN, for example, loads in less than half a second, due to using a CDN (i.e. Cloudflare). With CDNs, the RTTs are small enough to not matter.
- zeckalpha 10y agoSee also: https://https.cio.gov/ https://https.cio.gov/ I suspect they haven't caught up with the mandate.
- konklone 10y agoAs a White House memorandum, that mandate only applies to the executive branch. Though the GSA's HTTPS adoption dashboard does include legislative branch domains, including senate.gov: https://pulse.cio.gov/https/domains/#q=legislative https://pulse.cio.gov/https/domains/#q=legislative
- willnorris 10y agoSomewhat confusingly, pulse.cio.gov lists senate.gov as supporting HTTPS with an 'A' from SSL Labs. While that is of course technically correct, it doesn't tell the full story, since no actual content is served over HTTPS. Would it be worth trying to update pulse.cio.gov to detect cases like this? That's non-trivial to do in a reliable automated fashion, but seems like it might be worth the effort?
- konklone 10y agoYeah, I'm torn on it. It's clearly not the right information. But one of the benefits of an automated approach is that everyone's being treated equally, and people can't complain about unfair treatment. In the case of the Senate, their current configuration prevents them from using HSTS or enforcing HTTPS, so the other columns will still show as lacking.
- sathackr 10y agoPerhaps they don't have the resources to serve all requests over https at this time?
- mind-blight 10y agoI can't load the senate.gov website with the HTTPS Everywhere browser plugin. The plugin redirects the senate HTTP URL back to the No HTTPS warning. It's easy to get around by going incognito, but this would seriously confuse the average user.
- ohitsdom 10y agoThe average user doesn't have the HTTPS Everywhere plugin, and I assume most that do have it installed are used to dealing with this kind of bad configuration.