9 ms·

HTTPS Deployment Growing by Leaps and Bounds

74 points by DiabloD3 10y ago

HugoDaniel 10y ago
It is enforced by the browsers that implement HTTP2, it would be nice to see their adoption correlation.
yardie 10y ago
How will this work with hotspot capture portals? I have a dwindling list of sites I can use to check and see if my internet connection is down or just interrupted. And Apple/Microsoft don't always register the wifi is in captured so either I wait or I can open a browser to an unencrypted site and renew the session.
- irishsultan 10y ago
  That's what http://neverssl.com/ http://neverssl.com/ is for.
  - yardie 10y ago
    Now that is a handy link to have! Wish I knew of it sooner.
    - diafygi 10y ago
      I use example.com, which has all the scenarios without redirects. http://example.com http://example.com https://example.com https://example.com http://www.example.com http://www.example.com https://www.example.com https://www.example.com
- deleted 10y ago
  [deleted]
- lol768 10y ago
  The only reason those captive portals don't work is because the operators decided to use the huge hack of a solution that is MitM'ing unencrypted HTTP traffic and/or messing with DNS instead of working to ensure a standardised solution (such as RFC 7710) was available before rolling out this sort of technology. The current approach really is a joke. To be honest, I'm glad it's now back-firing with more sites using HTTPS (that they can't hijack connections to), maybe this will nudge the operators into doing things properly - whether that's using WPA Enterprise for username/password auth or using the DHCP option to tell new clients they need to visit an internal URL first to use the internet (no connection hijacking required).
- dewey 10y ago
  http://captive.apple.com http://captive.apple.com
QuadrupleA 10y ago
Am I the only one not all-in about moving everything to HTTPS? It's great for sites that track personal information and sensitive data that you wouldn't want snooped. But for a lot of sites (like phrasegenerator.com, one of mine) I'm not sure it makes sense - if someone in a coffee shop finds out what random phrase generator categories you've visited it's of pretty much no consequence. It's just an extra configuration hassle on the server, and a CPU burden on both ends. Admittedly minor, but why add a layer of complexity when it's not needed? I don't know. I use Let's Encrypt for the sites where it matters, and I'm all for it with search engines, email clients, anything with a password, etc. But as an engineer who likes to keep things simple, this seems like another layer of complexity borne out of one of those dogmatic 'best practice' rules that makes modern software slower, buggier and harder to maintain than it needs to be, despite our amazing modern hardware.
- dan1234 10y ago
  HTTPS would at least prevent shady WiFi providers from messing with your content before it gets to the user e.g. injecting ads into your content (or even replacing your own ads, if you use them).
- tristor 10y ago
  I understand your reasoning, but I respectfully disagree. The reason I think its important that ALL sites use HTTPS is that by encrypting everything "important" data becomes indistinguishable from "unimportant" data. This helps the security of the herd by making it more difficult for an attacker to identify what packets to collect and expend their compute resources on. In addition, anything we can do to normalize the use of encryption in such a way as basic crypto knowledge becomes mainstream is a win for the security of everyone. The fight isn't about a hacker stealing your passwords. The fight is about every single entity on the Internet being hostile towards user privacy with a strong monetary and power incentive to use any and every inch you give them to take a mile. So let's not give them any inches. Encrypt everything using the strongest cipher suites available and the best methods of identity verification we have. It may not be enough, but it's better than giving up and letting the baddies win without a fight. And to clarify before the inevitable reply points out that HTTPS isn't sufficient by itself to protect user privacy. Yes, I understand that. But it's an important basic building block for doing so.
makecheck 10y ago
I think it would be interesting to measure how well sites maintain their HTTPS too. I occasionally see improperly-configured certificate warnings (on corporate and even government web sites!). It may be that anyone who set up HTTPS once last month is going to have problems in 3 months or 6 months, and may not be set up properly for the long term. In this “modern” world, it seems past time for governments to start supplying digital IDs. Why for instance can’t every single person have a government-backed certificate of identity once they have done all the usual things that it would take to obtain a driver’s license or passport? And if you can count on a passport being valid for 10 years, why can’t you count on a government CA (say) to continue to validate your certificate for 10 years?
- dispose13432 10y ago
  Because then your ability to stay private and secure is tied to the government? If we're already talking about breaking the current TLS system, a DNS based security (Browsers include DNS keys, DNS hosts site keys) makes much more sense.
- riffic 10y ago
  > In this “modern” world, it seems past time for governments to start supplying digital IDs. Good graces just stop. While this may seem like a step in the right direction and offer a great amount of convenience, one can only imagine how this would be abused by authoritarian powers.
  - 234dd57d2c8db 10y ago
    Not just that, but the government has leaked millions of database records on everything from top-secret clearance holders to medical records to you name it. Their security posture is insulting.
- cm2187 10y ago
  Let's encrypt takes care of most of the maintenance. What would be great is for Microsoft to integrate let's encrypt into IIS. If someone feel like voting for that: https://windowsserver.uservoice.com/forums/310252-iis-and-web-server-role/suggestions/11609658-let-s-encrypt-integration https://windowsserver.uservoice.com/forums/310252-iis-and-we...

74 points by DiabloD3 10y ago

It is enforced by the browsers that implement HTTP2, it would be nice to see their adoption correlation.

How will this work with hotspot capture portals? I have a dwindling list of sites I can use to check and see if my internet connection is down or just interrupted. And Apple/Microsoft don't always register the wifi is in captured so either I wait or I can open a browser to an unencrypted site and renew the session.

irishsultan 10y ago
That's what http://neverssl.com/ http://neverssl.com/ is for.
- yardie 10y ago
  Now that is a handy link to have! Wish I knew of it sooner.
  - diafygi 10y ago
    I use example.com, which has all the scenarios without redirects. http://example.com http://example.com https://example.com https://example.com http://www.example.com http://www.example.com https://www.example.com https://www.example.com
deleted 10y ago
[deleted]
lol768 10y ago
The only reason those captive portals don't work is because the operators decided to use the huge hack of a solution that is MitM'ing unencrypted HTTP traffic and/or messing with DNS instead of working to ensure a standardised solution (such as RFC 7710) was available before rolling out this sort of technology. The current approach really is a joke. To be honest, I'm glad it's now back-firing with more sites using HTTPS (that they can't hijack connections to), maybe this will nudge the operators into doing things properly - whether that's using WPA Enterprise for username/password auth or using the DHCP option to tell new clients they need to visit an internal URL first to use the internet (no connection hijacking required).
dewey 10y ago
http://captive.apple.com http://captive.apple.com

QuadrupleA 10y ago

Am I the only one not all-in about moving everything to HTTPS? It's great for sites that track personal information and sensitive data that you wouldn't want snooped. But for a lot of sites (like phrasegenerator.com, one of mine) I'm not sure it makes sense - if someone in a coffee shop finds out what random phrase generator categories you've visited it's of pretty much no consequence. It's just an extra configuration hassle on the server, and a CPU burden on both ends. Admittedly minor, but why add a layer of complexity when it's not needed? I don't know. I use Let's Encrypt for the sites where it matters, and I'm all for it with search engines, email clients, anything with a password, etc. But as an engineer who likes to keep things simple, this seems like another layer of complexity borne out of one of those dogmatic 'best practice' rules that makes modern software slower, buggier and harder to maintain than it needs to be, despite our amazing modern hardware.

dan1234 10y ago
HTTPS would at least prevent shady WiFi providers from messing with your content before it gets to the user e.g. injecting ads into your content (or even replacing your own ads, if you use them).
tristor 10y ago
I understand your reasoning, but I respectfully disagree. The reason I think its important that ALL sites use HTTPS is that by encrypting everything "important" data becomes indistinguishable from "unimportant" data. This helps the security of the herd by making it more difficult for an attacker to identify what packets to collect and expend their compute resources on. In addition, anything we can do to normalize the use of encryption in such a way as basic crypto knowledge becomes mainstream is a win for the security of everyone. The fight isn't about a hacker stealing your passwords. The fight is about every single entity on the Internet being hostile towards user privacy with a strong monetary and power incentive to use any and every inch you give them to take a mile. So let's not give them any inches. Encrypt everything using the strongest cipher suites available and the best methods of identity verification we have. It may not be enough, but it's better than giving up and letting the baddies win without a fight. And to clarify before the inevitable reply points out that HTTPS isn't sufficient by itself to protect user privacy. Yes, I understand that. But it's an important basic building block for doing so.

makecheck 10y ago

I think it would be interesting to measure how well sites maintain their HTTPS too. I occasionally see improperly-configured certificate warnings (on corporate and even government web sites!). It may be that anyone who set up HTTPS once last month is going to have problems in 3 months or 6 months, and may not be set up properly for the long term. In this “modern” world, it seems past time for governments to start supplying digital IDs. Why for instance can’t every single person have a government-backed certificate of identity once they have done all the usual things that it would take to obtain a driver’s license or passport? And if you can count on a passport being valid for 10 years, why can’t you count on a government CA (say) to continue to validate your certificate for 10 years?

dispose13432 10y ago
Because then your ability to stay private and secure is tied to the government? If we're already talking about breaking the current TLS system, a DNS based security (Browsers include DNS keys, DNS hosts site keys) makes much more sense.
riffic 10y ago
> In this “modern” world, it seems past time for governments to start supplying digital IDs. Good graces just stop. While this may seem like a step in the right direction and offer a great amount of convenience, one can only imagine how this would be abused by authoritarian powers.
- 234dd57d2c8db 10y ago
  Not just that, but the government has leaked millions of database records on everything from top-secret clearance holders to medical records to you name it. Their security posture is insulting.
cm2187 10y ago
Let's encrypt takes care of most of the maintenance. What would be great is for Microsoft to integrate let's encrypt into IIS. If someone feel like voting for that: https://windowsserver.uservoice.com/forums/310252-iis-and-web-server-role/suggestions/11609658-let-s-encrypt-integration https://windowsserver.uservoice.com/forums/310252-iis-and-we...