5 ms·
Tim Berners-Lee has an article titled 'Web Security - "HTTPS Everywhere" harmful'[1]. He argues not that encryption is bad (as the title might ambiguously sugge
by eatbitseveryday 10y ago
Tim Berners-Lee has an article titled 'Web Security - "HTTPS Everywhere" harmful'[1]. He argues not that encryption is bad (as the title might ambiguously suggest), but that the use of a different URI prefix (http vs https) is harmful because it requires use of that prefix to ensure encryption and authentication is used. Rather, the HTTP prefix should be used for encryption, and upgraded in real-time by the client.
> A proposal then is to do HTTPS everywhere in the sense of the protocol but not the URI prefix. A browser gives the secure-looking user interface message, such as displaying the server certificate holder name above the document, only when the document has been fetched in an authenticated over an encrypted channel. This can be done by upgrading the HTTP to include TLS in real time, or in future cases by just trying encrypted version first.
He also states
> It is the user's task to ensure that their interactions are secure.
meaning, users are trained to look for the 's' but browsers are hiding the URI prefix, making this difficult.
[1] https://www.w3.org/DesignIssues/Security-NotTheS.html https://www.w3.org/DesignIssues/Security-NotTheS.html
- hannob 10y agoThis pops up every time. I don't really get what he's trying to tell us here. If we forward HTTP requests to HTTPS and use HSTS on top we're basically doing what he wants, right?
- pdpi 10y agoAs I understand it, he's suggesting that HTTP should incorporate something equivalent to STARTTLS as seen in some form in IMAP, POP3, FTP, LDAP, Postgres, and probably several others I'm forgrttingg
- marcosdumay 10y agoWell, that gave really bad results in SMTP IMAP, POP3, and LDAP. Postgres just does not suffer much because the client always knows wether to upgrade the connection or not. Ideally, we should be using DANE or some other kind of signed broadcasted info. Telling the user what happened is just a very good workaround (that will stay useful even if we change to DANE).
- tho9Ohx1eo 10y agoWhat bad results in IMAP or SMTP? In my experience this works as advertised.
- deleted 10y ago[deleted]
- eatbitseveryday 10y ago> If we forward HTTP requests to HTTPS and use HSTS Right, I think his point there was, the ecosystem has to make many changes to ensure the links are the "secure version": we create URLs with https, make browser changes to redirect (HSTS), use redirect in server software, etc. With "just" HTTP, all URLs are uniform, but the protocol is modified upon connection to 'upgrade' the link to something secure, instead. HSTS maybe wouldn't be needed (or would take a slightly different form).
- serge2k 10y ago> browsers are hiding the URI prefix Maybe browsers should stop with that idiocy then.
- jedberg 10y agoYou've clearly never worked with the 99% of people who use the internet who don't care about https, much less know what it is. They don't understand that when someone says "go to google.com" that something isn't wrong when the url bar says "https://google.com" https://google.com". They think they something is broken. Heck, Safari now be default doesn't even show you the path, they just show the domain, because once people get to foo.com they don't even understand about the paths, nor care.
- nitrogen 10y agoJust like learning what stoplights mean when driving a car, those users need to adapt to the basic signals of the web.
- groby_b 10y agoThose "basic signals of the web" are useless to the user. They carry no meaningful information for them. You don't need to learn about the Dewey decimal system when reading books, either. For the same reason - it's helpful for finding things, it allows you to classify books, and it doesn't matter at all since there are better ways to find books now.
- nommm-nommm 10y agoThere's no web surfing license or web surfing test, that's the big difference.
- eatbitseveryday 10y ago> people who use the internet who don't care about https, much less know what it is. While I agree, I do not believe this is an appropriate excuse for ignorance (I am not accusing you of anything, just criticizing the viewpoint itself). Computers are part of life. People know about antibiotics, vaccine, stem cells, black holes, and they know atomic radiation causes cancer and the same material can be used for atomic bombs, about wavelengths, and certain ones (UV) cause cancer by breaking DNA, etc. But, not technology? How is there such a well-formed ignorance when it comes to technology? It's fed to us by the media too, who cite "computer glitches"[1,2,3] when something goes wrong, or when there is a breach of the system and all credentials stolen. And, not understanding URLs leads to susceptibility to information being stolen from phishing attacks. Whose "fault" is there here? [1] "Glitch" http://money.cnn.com/2013/12/26/news/companies/delta-ticket-price-glitch/index.html http://money.cnn.com/2013/12/26/news/companies/delta-ticket-... [2] "Something broke" https://www.theguardian.com/technology/2016/feb/08/department-of-justice-homeland-security-hacking https://www.theguardian.com/technology/2016/feb/08/departmen... [3] "Glitch" http://www.nbcnews.com/video/nightly-news/48088061 http://www.nbcnews.com/video/nightly-news/48088061
- thedufer 10y agoAm I missing something, or is this suggestion trivially mitm-able? If you fail to forward the request the upgrade, neither side will know something is missing.
- spb 10y agoI think you're missing the part where a non-upgraded connection will be treated by the client as insecure and untrustable.
- thedufer 10y agoSo the suggestion is that in 1994 (when the https protocol was introduced) we should have put big scary warnings on every non-ssl site? I don't see how that could've gone well. It's now 22 years later and people still aren't ready for that.
- deleted 10y ago[deleted]
- oxplot 10y agoWhat I don't get is, why don't browsers try https as well as http when bare/http URI is entered so we can simply make servers stop listening on 80.