9 ms·

> Although I am genuinely surprised how much Google and others like Mozilla have had to drag many site owners kicking and screaming into HTTPS Personally i am

> Although I am genuinely surprised how much Google and others like Mozilla have had to drag many site owners kicking and screaming into HTTPS Personally i am very concerned about how much power Google has over the web - all it takes to change millions of how web sites work and look like is a random decision by Google. What bothers me even more is that most people do not seem to care much because they happen to agree with what Google is doing (so far). However i think that sites should make decisions on their configuration, layout, mobile friendliness and other things because they want to, not because they are forced by Google through taking advantage of their position and biasing what people see towards what they believe people should see. I do not like that Google basically dictates how the web should behave. (actually it isn't only the web, but also mail - just recently i had a mail of mine end up in the spam folder of someone else's GMail account because who knows what of the 1983847813 things i didn't configured exactly as Google likes it in my mail server... and of course the "solution" that many people present to this is to hand all my communications to Google)

Avamander 9y ago
> 1983847813 things And by that you mean?
- trav4225 9y ago
  Probably the dozens of various DNS, DKIM, SPF, SMTP behavior config, non-consumer-IP, etc., etc. boxes that must be ticked just right in order to not be considered a spammer these days. It's very difficult to get it all correct enough to keep a significant portion of the email sent through your SMTP site from being considered spam by mainstream email providers such as Google.
  - agentdrtran 9y ago
    yeah, but all of these things exist becuase of the sheer amount of spam that gets sent to people.
    - amelius 9y ago
      And it still doesn't work as desired.
      - Avamander 9y ago
        Gmail seems to filter all spam of mine though.
  - newman314 9y ago
    I agree that for most people, that's probably an exhausting list to go through. I'm a fan of Hardenize. I like using that site to help people understand what needs to be done. https://www.hardenize.com https://www.hardenize.com
    - trav4225 9y ago
      Interesting. Thanks for the tip!
  - wpietri 9y ago
    I can confirm that this is a giant pain in the ass. I use a non-standard address scheme (instead of the plus character as a tagged-address delimiter, I use the qmail approach, a dash character), so I can't easily move my domain to GMail. I occasionally end up in spam folders for reasons I can't discern, despite years of puzzling and discussion with a number of experts. The especially frustrating thing is that there's no way to find out why you've been binned. Even my friends who work at Google can't find out for me, much less get me whitelisted.
  - gsich 9y ago
    It's not hard.
  - Silhouette 9y ago
    It's very difficult to get it all correct enough to keep a significant portion of the email sent through your SMTP site from being considered spam by mainstream email providers such as Google. This doesn't change the problems of unreliable email because mail services are too aggressive, unfortunately. We recently got a bounced mail (not dumped in a spam folder, actively rejected) from a major university, telling us that the message looked like unsolicited bulk mail. The message was sent directly to a specific single customer in response to a purchase they had just made, contained information that we were required by law to provide to them, and was sent from a reputable host with things like SPF properly set up. That is simply broken, and it is 100% the fault of the mail service admins at the university.
    - jacquesm 9y ago
      If it was just the occasional small site it would not be such a problem, but even iCloud (Apple) and Outlook (Microsoft) get it wrong with some regularity from hosts that check all the right boxes.
    - trav4225 9y ago
      Yeah, agreed: it's all pretty broken, unfortunately.
fishywang 9y ago
> a random decision by Google What do you think is a random decision? > However i think that sites should make decisions on their configuration It's OK when they have ideas what they are doing, but that's not always the case. Before my trip to Kaua'i I googled some dive shops on the island to book a scuba diving trip. Every dive shops on the island seems to be using the same vendor to process online order of the reservation, which has the same form to input credit card number, and has some text around it saying "it's secure". They are not secure. They are on HTTP: https://twitter.com/fishywang/status/895133987525476354 https://twitter.com/fishywang/status/895133987525476354
- heywire 9y ago
  Wow. Unless this was some accidental configuration issue, this is inexcusable.
- slobotron 9y ago
  Those forms sit in an IFRAME and content is loaded via https. Example from http://seasportdivers.com/ http://seasportdivers.com/ : <iframe src="https://fareharbor.com/embeds/book/seasportdivers/?full-items=yes&u=1c09ae92-71c7-438e-97a3-361bdd69f77e&from-ssl=no"...> https://fareharbor.com/embeds/book/seasportdivers/?full-item...
  - eropple 9y ago
    That's not sufficient when the external page can be controlled and the iframe target set by it.
    - slobotron 9y ago
      Agreed that in situation like this it's near impossible to ascertain that iframe target wasn't altered, unless you already somehow know what it was before you got mitmd.
  - fiddlerwoaroof 9y ago
    Yeah, that’s a little better but can’t an attacker inject something in the surrounding the age that compromises the iframe? Or even rewrite the iframe to use a proxy under the attackers control?
Rapzid 9y ago
This is possible because how ubiquitous the idea of HTTPS-all-the-things is now, not the other way around. Further, HTTP IS insecure(the S literally means secure) so...
- jlarocco 9y ago
  I feel the push to HTTPS is bike shedding. It solves a problem, but it's not a big problem. Most people don't need HTTPS for most sites. I think it's safe to say most security and privacy breaches are due to poor practices on the back end or by end users.
  - brucephillips 9y ago
    The ability for third parties to sniff your traffic is a big problem.
    - ams6110 9y ago
      It's not a big problem if the traffic is inconsequential. If I'm passively browsing I don't really care too much. If I'm submitting forms, or working in a authenticated session, that's a different matter of course. And as easy as it is to get a certificate these days, what does it really prove? It stops 3rd party snooping, but then again so does a self-signed certificate.
      - niij 9y ago
        I think you're confusing authentication vs encryption. If you were MITMing someone and using a self signed cert for example.com that connection can be encrypted (if the user clicks through the warnings) but says nothing about your trust for the site.
        ams6110 9y ago
        Let's Encrypt, or any other low-cost SSL certificate, says very little about my trust for the site either. It's just too easy to get them to think they really mean anything.
aetherspawn 9y ago
You may be lacking SPF, DKIM or DMARC records. The lack of these records is a very reliable way to detect spambots that forge the From: field, so many mail sites now spam these by default.
_jal 9y ago
I do agree with you - it is appalling how much power Google has. I think a bit of perspective is helpful, though. There hasn't really been much of a span where there wasn't a de facto 900 Lb gorilla browser that threw its weight around. I think a lot of us watched this happen, but the various charts on this page are instructive: https://en.wikipedia.org/wiki/Browser_wars https://en.wikipedia.org/wiki/Browser_wars It appears that somehow the browser market trends toward an unstable near-monopoly of sorts, at least so far. So, meet the new boss, same as the old boss. At least https everywhere is a long-term public good that they're willing to take grief over forcing. It beats some of the other unilateral changes various once-dominant browsers forced.
- erikj 9y ago
  The complexity of the web platform is at least party to blame for this. The specifications for HTTP, HTML, DOM, CSS, JavaScript together are gargantuan and growing even further every year. This makes the development of Chrome's new competitors and the maintenance of already existing browsers extremely expensive, and it also hinders cross-browser compatibility of web applications as every browser fails to implement the monstrous specs flawlessly in its own unique ways.
  - sjellis 9y ago
    We are luckier than we deserve that Mozilla exists. If it was necessary to re-implement a modern Web browser completely from scratch today, it would probably take someone with the level of commitment of Richard Stallman to make it happen.
ldng 9y ago
> a random decision by Google It's not random and that it just might serve security is a side effect. It is about competitive advantage over other Ad Networks which might not implement HTTPS for AdSense. It is about raising both monetary and technical cost of server setup to make Google Cloud offer look even cheaper. It is very self serving.
nsgi 9y ago
Search engines and browser vendors have had a big influence on configuration, layout, mobile friendliness and other things long before HTTPS All The Things started to gain traction.

Avamander 9y ago

> 1983847813 things And by that you mean?

trav4225 9y ago
Probably the dozens of various DNS, DKIM, SPF, SMTP behavior config, non-consumer-IP, etc., etc. boxes that must be ticked just right in order to not be considered a spammer these days. It's very difficult to get it all correct enough to keep a significant portion of the email sent through your SMTP site from being considered spam by mainstream email providers such as Google.
- agentdrtran 9y ago
  yeah, but all of these things exist becuase of the sheer amount of spam that gets sent to people.
  - amelius 9y ago
    And it still doesn't work as desired.
    - Avamander 9y ago
      Gmail seems to filter all spam of mine though.
- newman314 9y ago
  I agree that for most people, that's probably an exhausting list to go through. I'm a fan of Hardenize. I like using that site to help people understand what needs to be done. https://www.hardenize.com https://www.hardenize.com
  - trav4225 9y ago
    Interesting. Thanks for the tip!
- wpietri 9y ago
  I can confirm that this is a giant pain in the ass. I use a non-standard address scheme (instead of the plus character as a tagged-address delimiter, I use the qmail approach, a dash character), so I can't easily move my domain to GMail. I occasionally end up in spam folders for reasons I can't discern, despite years of puzzling and discussion with a number of experts. The especially frustrating thing is that there's no way to find out why you've been binned. Even my friends who work at Google can't find out for me, much less get me whitelisted.
- gsich 9y ago
  It's not hard.
- Silhouette 9y ago
  It's very difficult to get it all correct enough to keep a significant portion of the email sent through your SMTP site from being considered spam by mainstream email providers such as Google. This doesn't change the problems of unreliable email because mail services are too aggressive, unfortunately. We recently got a bounced mail (not dumped in a spam folder, actively rejected) from a major university, telling us that the message looked like unsolicited bulk mail. The message was sent directly to a specific single customer in response to a purchase they had just made, contained information that we were required by law to provide to them, and was sent from a reputable host with things like SPF properly set up. That is simply broken, and it is 100% the fault of the mail service admins at the university.
  - jacquesm 9y ago
    If it was just the occasional small site it would not be such a problem, but even iCloud (Apple) and Outlook (Microsoft) get it wrong with some regularity from hosts that check all the right boxes.
  - trav4225 9y ago
    Yeah, agreed: it's all pretty broken, unfortunately.

fishywang 9y ago

> a random decision by Google What do you think is a random decision? > However i think that sites should make decisions on their configuration It's OK when they have ideas what they are doing, but that's not always the case. Before my trip to Kaua'i I googled some dive shops on the island to book a scuba diving trip. Every dive shops on the island seems to be using the same vendor to process online order of the reservation, which has the same form to input credit card number, and has some text around it saying "it's secure". They are not secure. They are on HTTP: https://twitter.com/fishywang/status/895133987525476354 https://twitter.com/fishywang/status/895133987525476354

heywire 9y ago
Wow. Unless this was some accidental configuration issue, this is inexcusable.
slobotron 9y ago
Those forms sit in an IFRAME and content is loaded via https. Example from http://seasportdivers.com/ http://seasportdivers.com/ : <iframe src="https://fareharbor.com/embeds/book/seasportdivers/?full-items=yes&u=1c09ae92-71c7-438e-97a3-361bdd69f77e&from-ssl=no"...> https://fareharbor.com/embeds/book/seasportdivers/?full-item...
- eropple 9y ago
  That's not sufficient when the external page can be controlled and the iframe target set by it.
  - slobotron 9y ago
    Agreed that in situation like this it's near impossible to ascertain that iframe target wasn't altered, unless you already somehow know what it was before you got mitmd.
- fiddlerwoaroof 9y ago
  Yeah, that’s a little better but can’t an attacker inject something in the surrounding the age that compromises the iframe? Or even rewrite the iframe to use a proxy under the attackers control?

Rapzid 9y ago

This is possible because how ubiquitous the idea of HTTPS-all-the-things is now, not the other way around. Further, HTTP IS insecure(the S literally means secure) so...

jlarocco 9y ago
I feel the push to HTTPS is bike shedding. It solves a problem, but it's not a big problem. Most people don't need HTTPS for most sites. I think it's safe to say most security and privacy breaches are due to poor practices on the back end or by end users.
- brucephillips 9y ago
  The ability for third parties to sniff your traffic is a big problem.
  - ams6110 9y ago
    It's not a big problem if the traffic is inconsequential. If I'm passively browsing I don't really care too much. If I'm submitting forms, or working in a authenticated session, that's a different matter of course. And as easy as it is to get a certificate these days, what does it really prove? It stops 3rd party snooping, but then again so does a self-signed certificate.
    - niij 9y ago
      I think you're confusing authentication vs encryption. If you were MITMing someone and using a self signed cert for example.com that connection can be encrypted (if the user clicks through the warnings) but says nothing about your trust for the site.
      - ams6110 9y ago
        Let's Encrypt, or any other low-cost SSL certificate, says very little about my trust for the site either. It's just too easy to get them to think they really mean anything.

aetherspawn 9y ago

You may be lacking SPF, DKIM or DMARC records. The lack of these records is a very reliable way to detect spambots that forge the From: field, so many mail sites now spam these by default.

_jal 9y ago

I do agree with you - it is appalling how much power Google has. I think a bit of perspective is helpful, though. There hasn't really been much of a span where there wasn't a de facto 900 Lb gorilla browser that threw its weight around. I think a lot of us watched this happen, but the various charts on this page are instructive: https://en.wikipedia.org/wiki/Browser_wars https://en.wikipedia.org/wiki/Browser_wars It appears that somehow the browser market trends toward an unstable near-monopoly of sorts, at least so far. So, meet the new boss, same as the old boss. At least https everywhere is a long-term public good that they're willing to take grief over forcing. It beats some of the other unilateral changes various once-dominant browsers forced.

erikj 9y ago
The complexity of the web platform is at least party to blame for this. The specifications for HTTP, HTML, DOM, CSS, JavaScript together are gargantuan and growing even further every year. This makes the development of Chrome's new competitors and the maintenance of already existing browsers extremely expensive, and it also hinders cross-browser compatibility of web applications as every browser fails to implement the monstrous specs flawlessly in its own unique ways.
- sjellis 9y ago
  We are luckier than we deserve that Mozilla exists. If it was necessary to re-implement a modern Web browser completely from scratch today, it would probably take someone with the level of commitment of Richard Stallman to make it happen.

ldng 9y ago

> a random decision by Google It's not random and that it just might serve security is a side effect. It is about competitive advantage over other Ad Networks which might not implement HTTPS for AdSense. It is about raising both monetary and technical cost of server setup to make Google Cloud offer look even cheaper. It is very self serving.

nsgi 9y ago

Search engines and browser vendors have had a big influence on configuration, layout, mobile friendliness and other things long before HTTPS All The Things started to gain traction.