11 ms·
The “Happy Path” to HTTPS
- SAI_Peregrinus 9y agoThe one part I disagree with is the section on Cloudflare. I agree that it's better than nothing, but you do have to trust them. I'm not sure that's wise. Not because I expect them to deliberately misuse the access, but because it's an increase in attack surface.
- _asummers 9y agoAlso their free cert terminates at their servers. If you're in e.g. GCE or AWS, that means part of your trip is unencrypted between their servers and yours, unless you pay for their FullSSL product. https://puu.sh/y1RUm/03b77351ee.png https://puu.sh/y1RUm/03b77351ee.png from https://www.cloudflare.com/ssl/ https://www.cloudflare.com/ssl/
- iancarroll 9y agoI’m fairly confident the full SSL option is free.
- _asummers 9y agoWe looked it up a few months ago and came to the opposite conclusion. Perhaps it's bundled into a larger CloudFlare plan, but on the free tier, I don't think so. I'm having trouble finding pricing for it on their site though, so I may be incorrect! But why even offer the FlexibleSSL option in that case?
- iancarroll 9y agoI don’t pay for CloudFlare but have access to it: https://imgur.com/a/Zgjfs https://imgur.com/a/Zgjfs The flexible SSL option is just much easier to deploy. It tacks on TLS without any server reconfiguration. Whether or not you want that is another thing, but it certainly has a market.
- _asummers 9y agoHmmm... Well glad I'm mistaken.
- jgrahamc 9y agoFull SSL is free on Cloudflare. It's on all plans and we'll either work with the certificate you have on the origin (e.g. one from a paid CA or Let's Encrypt) or we'll give you one for free (https://blog.cloudflare.com/cloudflare-ca-encryption-origin/ https://blog.cloudflare.com/cloudflare-ca-encryption-origin/) Literally, no reason to not use that option.
- voidmain 9y agoYeah, it's only been 6 months since https://en.wikipedia.org/wiki/Cloudbleed https://en.wikipedia.org/wiki/Cloudbleed. I guess we have to hope that they got religion after that :-/ It's kind of funny that we have Google pushing to force everything to be HTTPS, and in response everyone adopting a service provider that MITMs them through shared proxies written in a memory unsafe language, and doesn't require a certificate or even HTTPS from the origin site (so that third parties can still do MITM attacks), etc. It's still an improvement over an `http` scheme site in an absolute sense -- at least it protects customers from their own ISP or unencrypted wifi -- but it also hides the insecurity from the user. Oh, well. Maybe what we really need is strict liability for data breaches. A few companies getting successfully sued for $100 per user account after a breach would actually start to change the culture around security.
- jacquesm 9y agoI see CF as a step backwards at this point. I'm sure they have learned their lesson but their response was absolutely terrible and that makes me wonder about their leadership. As long as that doesn't change there is a good chance that there will be a repeat at some point and so I'm not comfortable with placing that much trust in them. Fortunately I don't need them, if you are in a position where a CDN is a must then that is a decision you're going to have to live with (or find another one than CF).
- voidmain 9y agoIt's really not my area of expertise, but it seems to me that today you could use subresource integrity to serve everything static from a CDN without having to trust it a lot. The real problem is the other stuff they do, like defense against DOS attacks.
- jacquesm 9y agoIt's not about subresource protection, it's about them essentially man-in-themiddle-ing each and every connection to your website which defeats - imo - the whole purpose of using HTTPS in the first place. What's the point if it isn't end-to-end?
- greggman 9y agostill no solutions for IoT devices serving webpages like routers , nas, ip cameras, etc
- prophesi 9y agoI'm hoping in the future it'll be easier (in a secure fashion) to implement self-signed certs for those sorts of things that only have to serve pages on a local network.
- emilecantin 9y agoWe had a lengthy discussion today in the SignalK project (http://signalk.org/ http://signalk.org/) about exactly that. The best approach I've seen so far is the way Plex has done it: https://en.wikipedia.org/wiki/Plex_(software)#SSL https://en.wikipedia.org/wiki/Plex_(software)#SSL
- prophesi 9y agoWow, that's an ingenious solution! It's such a shame that this requires jumping through so many hoops (and becoming a Registration Authority... Not sure how difficult or pricy that would be). And I never heard of Signal K. That is an awesome project, and definitely could benefit from end-to-end encryption for transporting marine data.
- emilecantin 9y agoYeah, becoming a CA is kind of a PITA. I think a "Sub-domain CA" would be a kind of happy middle ground, as it wouldn't need to be trusted as much. Also, the Plex approach requires some DNS trickery, which works well when you're online, but on a boat in the middle of an ocean, it might be harder... We need a way to secure local-only communications, with local-only names (like .local). While we're at it, mDNS support in browsers would be nice, too.
- lmm 9y ago
- knieveltech 9y ago+1 for LetsEncrypt. The web agency I work for standardized on this for all new builds and existing clients when their existing cert expires. Zero to HTTPS in less than five minutes.
- DoodleBuggy 9y agoFunny timing, I was speaking earlier today with a startup CTO who was annoyed with various HTTPS problems. Put simply, businesses don't want to deal with this stuff. That means they'll pay for it, that's an opportunity for someone. Offer this "happy path" as a service, companies will pay for it right now.
- mrkurt 9y agoEveryone is offering this happy path. And people do pay for it, but the market price for "a Lets Encrypt cert on my site" is $0. It's mostly just a great way to get people started on a more valuable service.
- michaelbuckbee 9y agoLets Encrypt works fine for personal sites, etc. but it absolutely crushes the use case of being a large scale service needing to support thousands of individual sites, each with their own SSL cert. Heroku, Hubspot, Shopify, etc. all have implemented LetsEncrypt and UX wise, is now pretty much just the default.
- netzone 9y agoYup. I use LetsEncrypt for 12 sites with their own individual certs, and even that gets painful, but managable.
- majewsky 9y agoIf that is painful, you should have automated it. I don't even know how many certs I have ATM (maybe 20 or 30 or so), because it's so easy to add new domains. I described my setup here: https://blog.bethselamin.de/posts/how-i-run-certbot.html https://blog.bethselamin.de/posts/how-i-run-certbot.html
- ge96 9y agoDon't forget the 90 day bot generated event to update your cert
- jacquesm 9y agoWhile I love the concept of Cloudflare and know and like many of the people behind it I'm no longer promoting them. Cloudflare royally messed up and then messed up their response as well. I can forgive the former but I have a hard time with the latter. Also, unless your site is high traffic or get hit with DDOS attacks I don't see any need for it. Just optimize your site and you'll be fine even without a CDN.
- dfabulich 9y agoWhat did they mess up?
- jacquesm 9y agohttps://en.wikipedia.org/wiki/Cloudbleed https://en.wikipedia.org/wiki/Cloudbleed
- misterbowfinger 9y agoHa for a second I thought you were talking about the ordeal with the Daily Stormer ;)
- SAI_Peregrinus 9y agoWhile he's talking about cloudbleed that affair does raise questions as to their reliability. A spur of the moment decision like that doesn't give much confidence in their integrity. It's fully understandable of course (they're Nazis) but it was still a decision to terminate service with no warning. You're probably safe from such things if you're not a Nazi, but it's not 100% safe.
- omginternets 9y agoFirst they came for the Nazis...
- deleted 9y ago[deleted]
- systematical 9y agoNice article. At my company, $9 per year SSL through namecheap means we go with that for the support, which has come in handy. For non-critical things and my personal stuff I am on letsencrypt. If you are looking to go beyond this article, use a free SSL scanner such as https://www.htbridge.com/ssl/ https://www.htbridge.com/ssl/ which will dig into cipher suites which comes into play with HIPAA and PCI.
- imron 9y ago> which has come in handy How much support can you really get for $9 a year? Let's encrypt is basically set and forget (making sure to also set up appropriate notifications for when things go wrong).
- dalore 9y agoYeah for $9 a year they are getting the service where when their cert expires they have to manually go through all the process again. Making sure to manually create a signing request and keeping keys secure. For $0 a year with letsencrypt you can have it autorenew and not need any support. Also what support would a https provider provide other then here are the commands to generate a csr?
- ahochhaus 9y agoDoes using `Content-Security-Policy: upgrade-insecure-requests` in addition to HSTS add value?
- lstamour 9y agoYep: HSTS only applies to your site, while upgrade-insecure-requests applies to every resource your site loads, even on third-party domains? Meanwhile, upgrade-insecure-requests does not replace HSTS because it doesn't help secure links from offsite or direct entry, which HSTS solves especially with preloading. Monitoring CSP headers and actually fixing bugs would help fix things in browsers that don't support upgrade-insecure-requests.
- ahochhaus 9y agoThanks for the clarification. I did not realize that `upgrade-insecure-requests` applies cross origin. If you do not load any insecure content is setting HSTS and `block-all-mixed-content` the best strategy?
- lstamour 9y agoAs pointed out by Microsoft earlier today, MDN is one of the best resources on this sort of thing. Here they write: > The upgrade-insecure-requests directive is evaluated before block-all-mixed-content and If the former is set, the latter is effectively a no-op. It is recommended to set one directive or the other – not both. Source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/block-all-mixed-content https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co... and https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-requests https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co... Yes they are similar, and you have to watch which one you set -- but you can also achieve a similar effect at a more granular level using CSP as also indicated in MDN. These rules are equivalent to saying `default-src https:` in the CSP rule. In fact, the best option is individual CSP directives which can get more granular than the `https:` scheme alone, because you can then specify which trusted third-party domains (if any) are allowed to load resources on your pages and conditions (like nonces) for running script tags, data URIs, etc. After all, your secure third-party resources could still have servers compromised and they might then send malicious assets over SSL to your unsuspecting users' browsers. CSP, if trusted enough to set it to block instead of just report (though you can run both modes at the same time), is one of the best defence-in-depth ways to protect your page from attack, right up there with HttpOnly and Secure flags on cookies. https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#Secure_and_HttpOnly_cookies https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#Se... If you're looking for checklists, have a look at https://wiki.mozilla.org/Security/Guidelines/Web_Security https://wiki.mozilla.org/Security/Guidelines/Web_Security and https://blog.appcanary.com/2017/http-security-headers.html https://blog.appcanary.com/2017/http-security-headers.html though remember no checklist is going to deliver bulletproof security on its own (you'll have to inspect your app and environment for flaws, implement monitoring tools, etc.), and blindly implementing security headers or features without knowing what they do can obviously break your app. (Again, monitoring your app can help.)
- peterwwillis 9y ago" [..] we've known it's coming for quite a while now [..]" Who is "we" ? A lot of people are about to start calling random tech support numbers asking them why their internet is not secure. However, I think the UI changes coming in are a vastly improved solution to mitm than the cheap hack that is HSTS. I'm also about 90% sure that in two years, most people will have at least one custom CA cert from a job, isp, or other as-yet-undetermined need to inspect content. I also expect it to become commonplace to ignore certificate errors, as the number of new HTTPS sites also increases the amount of faulty TLS setup. And what's really annoying is that HTTPS doesn't really affect user security much. It mainly just affects privacy. Most people are not hacked by a man in the middle. They're hacked by a person accessing a database, or running an authentic looking website, or exploiting a bug. So while a lot of headaches will be caused by adopting HTTPS everywhere, people won't necessarily be any safer.
- creatonez 9y ago> A lot of people are about to start calling random tech support numbers asking them why their internet is not secure Good. More pressure on all sorts of companies to add TLS to their ancient systems.
- MrManatee 9y ago> And what's really annoying is that HTTPS doesn't really affect user security much. It mainly just affects privacy. Most people are not hacked by a man in the middle. They're hacked by a person accessing a database, or running an authentic looking website, or exploiting a bug. So while a lot of headaches will be caused by adopting HTTPS everywhere, people won't necessarily be any safer. Maybe I misunderstood, but it sounds like you're criticizing HTTPS for its success. People only rarely get hacked using man-in-the-middle attacks, because popular sites are already using HTTPS. If they didn't, I'm sure they would be MITM-hacked all the time.
- peterwwillis 9y agoMITM is a lot more work for a lot less payoff. Say you found a small ISP that allows DNS cache poisoning. Once you succeed you get X users over a day or two. It's still a fraction of users of a small ISP. With a botnet, they can collect hundreds of thousands to millions of users, and all they have to do is own one site. Or they can send spam all day and not have to own anything. Of course MITM is a concern, it's just not the biggest concern, IMO.
- floatboth 9y agoCloudbleed, security of MITM… all that stuff is NOT why I dislike CloudFlare. It's the centralization of the internet! If everyone except Google/Netflix/Facebook/… is routed through CloudFlare, the internet would be even more centralized than ever :(
- ge96 9y agoJust putting this out there, check out Qualyss to see how your HTTPS is. Maybe using weak cipher suite etc...
- k__ 9y agoI have to say, with LetsEncrypt the whole things got rather simple. I once needed a HTTPS server for IPA distribution and got this set up in under an hour for my existing nginx.
- HurrdurrHodor 9y agoThe appropriate way for users to defend themselves is to simply install https-everywhere and check "Block all unencrypted requests". This avoids sslstrip, requires no redirect magic and no HSTS. Although somebody should really patch it to just display big fat warnings because it is somewhat annoying to turn it on and off all the time.
- chrismorgan 9y agoI just got a 502 Bad Gateway from Cloudflare. Reloaded the page and it worked, but mildly bizarre.
- fps 9y agoAs much as I appreciate https for sensitive information, I feel that for many things, it also functions as a way to lock down the standard protocols of the web and lock users in to proprietary software and services. No longer can you spy on the requests that that piece of closed source software is making while it phones home. No longer can you rescue and reuse IoT devices whose manufacturers have shut down their servers, or refuse to provide updates or promised functionality. Now all communications are inscrutable binary streams that can't be examined or improved, especially from devices that don't allow you to upload a replacement certificate authority.
- 767576 9y agoooooooooooooo.+oooooooo ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo +3 .3+/0,0./ 3+* 3 ll
- 767576 9y agoplease delete, cat + keyboard