6 ms·

It's worth pointing out that this is an effort to secure government sites: "A Policy to Require Secure Connections across Federal Websites and Web Services" Wh

by Steeeve 10y ago

It's worth pointing out that this is an effort to secure government sites: "A Policy to Require Secure Connections across Federal Websites and Web Services" Which makes sense to a degree and on the surface. But it doesn't actually make sense. From an individual standpoint of "my personal government held information should be secure" it certainly does. From the standpoint that the government should provide easy and open access to data it does not. And let's face it - browser warnings about bad certificates are generally ignored, and the fact that they haven't presented one provides no real confidence that a connection is in fact secure. Should I really have to pay someone to find out if a car has been used as a rental car or in an accident? Is there a real benefit to that data being transmitted via an https session vs. a http session? If I'm looking at a congressman's voting history, is there a real benefit to that data being transmitted via an https session vs. http? What's the drawback? There's a layer of complexity in the way that isn't necessary or helpful. Anybody who has done web based automation has run into plenty of issues with expired / incorrect / insecure / misconfigured ssl certificates. And we've all seen trusted certificate authorities compromised. Heck, some of us compromise secure http ourselves pretty regularly as part of the development and testing cycle. What happens when we're accessing data from a custom device with minimal resources? Text processing and network connectivity is one thing. Adding in encryption support and maintaining SSL is a whole different problem to deal with. And what happens when a guy working a low level office wants to expose a web service for something like viewing an event calendar? There's additional work to be done to obtain certificates and configure his web server to use them. So now maybe he doesn't do it because the bureaucracy in place is too painful. --- I'm not a fan of making blanket decisions based on flimsy logic. I find it ironic that their first reason for doing this points to a TAG finding that not only points out several drawbacks, but lays out that one of the primary reasons for preferring secure communication would be to minimize pervasive government monitoring.

cesarb 10y ago
Like many, you are forgetting the other half of what TLS provides. It's not only confidentiality, it's also authenticity. It ensures not only that nobody can eavesdrop the connection within the browser and the server, but also that nobody can modify it, for instance to inject a piece of Javascript with a browser exploit.
- throwaway6845 10y ago
  He's not necessarily "forgetting" it and I wish HTTPS-everywhere advocates would stop ascribing forgetfulness or bad motives. Some of us have a different opinion based on our own genuinely-held beliefs. Requiring HTTPS everywhere is weighing certain factors above others. For many people, encryption and consequent lack of snooping/MITMing is an absolute which outweighs all other possible factors. That's fine. You're entitled to hold that belief. But please don't accuse others, who don't hold that as a trumps-everything absolute, of "forgetting" or (like the guy upthread who said "You being against HTTPS everything, is the same as being in support of MITM attacks somewhere") arguing in bad faith.
  - dispose13432 10y ago
    >Some of us have a different opinion based on our own genuinely-held beliefs Such as? Browsing a website with an adblocker in a public place may literally give me a virus. That's what HTTPS everywhere protects against.
    - throwaway6845 10y ago
      Browsing any infected website, HTTPS or otherwise, may give you a virus.
      - konklone 10y ago
        Right, but if it's HTTPS, only the website can give you a virus. If it's HTTP, the website can give you a virus, plus the owner of any network device your requests traveled through on the way to and from the website. That's often a lot of owners.
  - benchaney 10y ago
    But he did forget the integrity benefits in his post. I understand that some people have different views, but if someone overlooks a significant point, it is ridiculous to get offended when someone else points it out.
- 10y ago
ufmace 10y ago
> If I'm looking at a congressman's voting history, is there a real benefit to that data being transmitted via an https session vs. http? Yes. Say you're a fan of Party A, and you'd like to find out whether your congressman voted the way that you like on some issue. Wouldn't it be a shame if your ISP was a fan of Party B, and tweaked the page in-flight to show you the voting results that you were hoping for, instead of what really happened? Or if some other organization found a way to inject some JS into the page to do that? For that matter, maybe Party A did it because they wanted hide a vote he had to make that they know might anger his supporters, but they'd rather have another Party A guy in Congress, even if he isn't perfect, than risk losing the seat to Party B. Think all of that is paranoid nonsense? Well, pretty equivalent accusations have been thrown around in this election cycle by both sides, many by very mainstream organizations. I don't know that anything like this has happened, but it doesn't seem quite so crazy these days to say that it very well could.
matt4077 10y ago
> And let's face it - browser warnings about bad certificates are generally ignore That's getting harder and harder to do. Doesn't Chrome require you to find three hidden buttons and enter a password to ignore the warning? > Should I really have to pay someone to find out if a car has been used as a rental car or in an accident? I don't follow... You don't need a certificate and the site can get a free one from LetsEncrypt > If I'm looking at a congressman's voting history, is there a real benefit to that data being transmitted via an https session vs. http? ... not yet :) But yes, it may allow to make certain conclusions regarding your interests, maybe your place of residence etc. But the larger idea here is to get users and the infrastructure accustomed to encryption. Chrome and Safari, for example, are moving towards treating any non-encrypted site as a security risk. That only works if the overwhelming majority of sites actually are encrypted, or it will just annoy people. > There's a layer of complexity in the way that isn't necessary or helpful which is motivation to improve the tooling. With LetsEncrypt the whole process has already become much easier. It's only a matter of time until SSL just works, the same way lots of other protocol negotiations invisibly happen today. > What happens when we're accessing data from a custom device with minimal resources They'll have slightly less-minimal resources. SSL really doesn't require a Cray anymore. IoT-devices without encryption are a privacy nightmare, anyway. Some of them actually have access to extremely sensitive data or, even worse, can control critical hardware – c.f. pacemakers. > And what happens when a guy working a low level office wants to expose a web service for something like viewing an event calendar? He'll use google calendar, same as now. People who can't configure SSL have no business exposing services to the internet.
scarmig 10y ago
Use case that's pretty clear: Many government websites provide a way to contact the government, either through address, email, or phone. An attacker can MITM the HTTP connection and replace that contact info with whatever they choose. People place an incredibly high amount of trust in the government and what the government asks for, so every incoming call would have a >50% chance of resulting in complete and total identity theft.
- Steeeve 10y ago
  If I can MITM your http connection, I can MITM your https connection. But again, I'm not saying that there are no benefits to TLS, just that a blanket policy requiring TLS for _every_ government web service is a bad idea. One that prefers TLS or a best-effort-to-support TLS policy would make more sense. Look at the history a bit. InCommon's use of insecure hashes required that all clients re-issue their certificates in order to avoid browser warnings. At the University level that was impractical to do quickly. At a federal government level? That's a whole different beast. And look at heartbleed. How long did it take the federal government to make all resources secure again? Is it actually a completed project? There's operational overhead to consider. There's the fact that MITM for http is minimally different than https. There's the plain and simple fact that a lot of data simply does not need to be secure. And there's the fact that there are already existing problems with making data available to the public at large. If you want to provide confidence in government data, you could say that all certificates used by government resources are secured by X,Y, and Z certificate authorities and that would be a legitimate benefit.
  - yjftsjthsd-h 10y ago
    "There's the fact that MITM for http is minimally different than https." Unless I'm missing something important, that can be prevented with key pinning.
    - willstrafach 10y ago
      Key pinning is not even needed. Entire point of SSL/TLS is to ensure end to end authenticity and confidentiality. I believe the above poster does not fully understand SSL/TLS at all.

by Steeeve 10y ago

cesarb 10y ago

Like many, you are forgetting the other half of what TLS provides. It's not only confidentiality, it's also authenticity. It ensures not only that nobody can eavesdrop the connection within the browser and the server, but also that nobody can modify it, for instance to inject a piece of Javascript with a browser exploit.

throwaway6845 10y ago
He's not necessarily "forgetting" it and I wish HTTPS-everywhere advocates would stop ascribing forgetfulness or bad motives. Some of us have a different opinion based on our own genuinely-held beliefs. Requiring HTTPS everywhere is weighing certain factors above others. For many people, encryption and consequent lack of snooping/MITMing is an absolute which outweighs all other possible factors. That's fine. You're entitled to hold that belief. But please don't accuse others, who don't hold that as a trumps-everything absolute, of "forgetting" or (like the guy upthread who said "You being against HTTPS everything, is the same as being in support of MITM attacks somewhere") arguing in bad faith.
- dispose13432 10y ago
  >Some of us have a different opinion based on our own genuinely-held beliefs Such as? Browsing a website with an adblocker in a public place may literally give me a virus. That's what HTTPS everywhere protects against.
  - throwaway6845 10y ago
    Browsing any infected website, HTTPS or otherwise, may give you a virus.
    - konklone 10y ago
      Right, but if it's HTTPS, only the website can give you a virus. If it's HTTP, the website can give you a virus, plus the owner of any network device your requests traveled through on the way to and from the website. That's often a lot of owners.
- benchaney 10y ago
  But he did forget the integrity benefits in his post. I understand that some people have different views, but if someone overlooks a significant point, it is ridiculous to get offended when someone else points it out.
10y ago

ufmace 10y ago

> If I'm looking at a congressman's voting history, is there a real benefit to that data being transmitted via an https session vs. http? Yes. Say you're a fan of Party A, and you'd like to find out whether your congressman voted the way that you like on some issue. Wouldn't it be a shame if your ISP was a fan of Party B, and tweaked the page in-flight to show you the voting results that you were hoping for, instead of what really happened? Or if some other organization found a way to inject some JS into the page to do that? For that matter, maybe Party A did it because they wanted hide a vote he had to make that they know might anger his supporters, but they'd rather have another Party A guy in Congress, even if he isn't perfect, than risk losing the seat to Party B. Think all of that is paranoid nonsense? Well, pretty equivalent accusations have been thrown around in this election cycle by both sides, many by very mainstream organizations. I don't know that anything like this has happened, but it doesn't seem quite so crazy these days to say that it very well could.

matt4077 10y ago

> And let's face it - browser warnings about bad certificates are generally ignore That's getting harder and harder to do. Doesn't Chrome require you to find three hidden buttons and enter a password to ignore the warning? > Should I really have to pay someone to find out if a car has been used as a rental car or in an accident? I don't follow... You don't need a certificate and the site can get a free one from LetsEncrypt > If I'm looking at a congressman's voting history, is there a real benefit to that data being transmitted via an https session vs. http? ... not yet :) But yes, it may allow to make certain conclusions regarding your interests, maybe your place of residence etc. But the larger idea here is to get users and the infrastructure accustomed to encryption. Chrome and Safari, for example, are moving towards treating any non-encrypted site as a security risk. That only works if the overwhelming majority of sites actually are encrypted, or it will just annoy people. > There's a layer of complexity in the way that isn't necessary or helpful which is motivation to improve the tooling. With LetsEncrypt the whole process has already become much easier. It's only a matter of time until SSL just works, the same way lots of other protocol negotiations invisibly happen today. > What happens when we're accessing data from a custom device with minimal resources They'll have slightly less-minimal resources. SSL really doesn't require a Cray anymore. IoT-devices without encryption are a privacy nightmare, anyway. Some of them actually have access to extremely sensitive data or, even worse, can control critical hardware – c.f. pacemakers. > And what happens when a guy working a low level office wants to expose a web service for something like viewing an event calendar? He'll use google calendar, same as now. People who can't configure SSL have no business exposing services to the internet.

scarmig 10y ago

Use case that's pretty clear: Many government websites provide a way to contact the government, either through address, email, or phone. An attacker can MITM the HTTP connection and replace that contact info with whatever they choose. People place an incredibly high amount of trust in the government and what the government asks for, so every incoming call would have a >50% chance of resulting in complete and total identity theft.

Steeeve 10y ago
If I can MITM your http connection, I can MITM your https connection. But again, I'm not saying that there are no benefits to TLS, just that a blanket policy requiring TLS for _every_ government web service is a bad idea. One that prefers TLS or a best-effort-to-support TLS policy would make more sense. Look at the history a bit. InCommon's use of insecure hashes required that all clients re-issue their certificates in order to avoid browser warnings. At the University level that was impractical to do quickly. At a federal government level? That's a whole different beast. And look at heartbleed. How long did it take the federal government to make all resources secure again? Is it actually a completed project? There's operational overhead to consider. There's the fact that MITM for http is minimally different than https. There's the plain and simple fact that a lot of data simply does not need to be secure. And there's the fact that there are already existing problems with making data available to the public at large. If you want to provide confidence in government data, you could say that all certificates used by government resources are secured by X,Y, and Z certificate authorities and that would be a legitimate benefit.
- yjftsjthsd-h 10y ago
  "There's the fact that MITM for http is minimally different than https." Unless I'm missing something important, that can be prevented with key pinning.
  - willstrafach 10y ago
    Key pinning is not even needed. Entire point of SSL/TLS is to ensure end to end authenticity and confidentiality. I believe the above poster does not fully understand SSL/TLS at all.