6 ms·

I feel the push to HTTPS is bike shedding. It solves a problem, but it's not a big problem. Most people don't need HTTPS for most sites. I think it's safe to

I feel the push to HTTPS is bike shedding. It solves a problem, but it's not a big problem. Most people don't need HTTPS for most sites. I think it's safe to say most security and privacy breaches are due to poor practices on the back end or by end users.

brucephillips 9y ago
The ability for third parties to sniff your traffic is a big problem.
- ams6110 9y ago
  It's not a big problem if the traffic is inconsequential. If I'm passively browsing I don't really care too much. If I'm submitting forms, or working in a authenticated session, that's a different matter of course. And as easy as it is to get a certificate these days, what does it really prove? It stops 3rd party snooping, but then again so does a self-signed certificate.
  - niij 9y ago
    I think you're confusing authentication vs encryption. If you were MITMing someone and using a self signed cert for example.com that connection can be encrypted (if the user clicks through the warnings) but says nothing about your trust for the site.
    - ams6110 9y ago
      Let's Encrypt, or any other low-cost SSL certificate, says very little about my trust for the site either. It's just too easy to get them to think they really mean anything.
      - dragonwriter 9y ago
        An expensive DV certificate doesn't really say any more than a cheap one, except that the person buying it had money to burn. Whether an EV certificate should do much more for trust than DV is a matter of some debate.
      - tialaramex 9y ago
        All new certificates for DNS names in the Web PKI today (and for some time now) must result from the CA having used one of the Ten Blessed Methods to validate the Applicants control over the name, regardless of who paid how much. Let's Encrypt offered three of the Ten, but one was discovered to be flawed due to the way some major bulk hosting services are configured, so that leaves two (of Nine, since in practice any implementation of the Tenth Blessed Method is flawed the same way). Even flawed Blessed Methods are far superior to the checking (basically none) we can reasonably expect from a normal person using a web browser. But still, improvements upon the Blessed Methods are a topic of public discussion, if you think you genuinely have a better way you should definitely let the CA/B Forum or m.d.s.policy know about it.
      - niij 9y ago
        Having any valid cert (DV or otherwise) proves that you are viewing the example.com that the owner of example.com wants you to see. Without a certificate, you can/will be MITMed. >It's just too easy to get them to think they really mean anything. I'm not sure what you mean by this: 1. Are you saying that there is a vulnerability where you can get a valid certificate for a domain you don't own? 2. Do you mean the fact that valid owners of a domain can get a certificate easily? If 1, please provide more info. If 2, why is that a bad thing?
  - lolsal 9y ago
    The traffic is only inconsequential until it's not. It's a privacy matter, not strictly a security matter.
    - deleted 9y ago
      [deleted]
- jlarocco 9y ago
  That's simply not true. 99% of the time I could care less if a middle man sniffs my traffic. HTTPS is for that other 1% of the time. The hypocrisy here is amazing, too, because while pushing HTTPS, Google itself is actively following everybody around, tracking everything they do online.
  - brucephillips 9y ago
    Blackmail, economic exploitation, political repercussions including imprisonment are all real consequences of surveillence.
    - jlarocco 9y ago
      I'd like to see something comparing the number of people blackmailed or exploited by sniffed HTTP traffic versus the number of people affected by back end exploits or social engineering. Everybody screams about HTTPS because it's easy to do, but it's a tiny problem in the grand scheme of things, and it gives people a misplaced sense of security.
      - dane-pgp 9y ago
        To be fair, there's not much that browser makers can do about back end exploits and social engineering. Google aren't in the business of writing back ends for third parties, and it's difficult to know if a website's back end is insecure, so I don't know who you expect to hear "scream", or who they would scream about. The article is about one practical measure that a browser maker has taken to improve the piece of user-facing software that they are responsible for, and some users of that software are applauding this improvement. Having said that, I do accept your over all point that there is a lot of other work that still needs to be done in securing the web. As you suggest, that's not going to be easy, but let's not fail to fix the things that we can fix already.
  - Diederich 9y ago
    https is about two big things in my mind. The obvious one is that it makes your traffic hard or impossible to sniff. What's often overlooked is that it also makes your session highly resistant to tampering by 3rd parties. These parties include: 1. Anybody who might have access to your home WIFI network. 2. Your Internet Service Provider. There's been plenty of documented cases where ISPs have injected 'harmless' HTML. 3. Any number of bad actors if you're using any kind of public WIFI. 4. National actors. That's the NSA in the United States, where we have clear evidence that they have been capable of intercepting unsecured connections and injecting unreleased attacks into targeted computers. This is not tinfoil hat stuff. The benefit of https is undeniably greater than the cost. I'm not crazy about how Google throws their weight around in a lot of cases either. But in this case, I think they're doing the right thing.
- takeda 9y ago
  The real reason for Google pushing this is is due to ISPs having genius idea of start replacing ads on sites with their own. Google is not doing this without interest, but I guess it overall is beneficial for us as well...
paulie_a 9y ago
It is a huge problem
dingo_bat 9y ago
I agree. Nobody is attacked using MITM, which is the only thing HTTPS prevents. Most credential leaks are due to insufficient security at the server, not the connection.
- jsmthrowaway 9y ago
  > Nobody is attacked using MITM, which is the only thing HTTPS prevents The only thing? I can think of four others off hand. That said, the “only” thing is pretty important in itself.
  - dingo_bat 9y ago
    It's not important at all for most people. How many times have you been MITM'd? I'll tell you about me: zero. Nobody cares enough about me to do that. You know what people get bitten by? Hacked servers where the whole website is under a phisher's control or malicious website which downloads malware to your machine or sells your data (eg, Google, Facebook). Maybe my knowledge is lacking, so please tell me what those 4 things are that you're being so elusive about. I suspect they are also as unlikely as MITM.
    - roblabla 9y ago
      I've been MITM'd numerous time in the past. I've been MITM by corporate netorks filtering my traffic. I've been MITM'd by scummy and public wifi hotspots trying to inject ads. My own domain provider once MITM'd my domain in a weird attempt to tell me my domain was expiring... I'm not trying to protect myself from a targeted attack. I'm trying to protect myself from the enormous amount of scummy behavior in this whole industry. When I connect to my bank, I want my data to be secure not only against malicious activity, but negligence and incompetence. This is the threat model that HTTPS-Everywhere protects against. Sure, people get bitten by viruses and phishes. But let's fix things one step at a time.
      - dingo_bat 9y ago
        > When I connect to my bank, I want my data to be secure not only against malicious activity, but negligence and incompetence. What bank do you use that doesn't use https already? Maybe it's time to change your bank rather than force every website in the world to switch to https.
jdavis703 9y ago
Man in the middle attacks are more common than you'd think. Many corporate networks inspect outbound network traffic. I've heard of some coffee shop WiFi spots that also modify traffic to inject ads. Having someone tamper with your traffic, is a big deal. Especially consider many websites people visit are sensitive in nature, e.g. Google almost certainty knows more about me than any other human being -- they might even know more about me than I know about myself.
- Silhouette 9y ago
  Most corporate networks are going to inspect or block HTTPS traffic too. They have security and regulatory compliance concerns, and consequently deploying tools capable of intercepting that traffic is pretty much the norm these days. It's all but certain that if you have a work PC then your contract/handbook/etc. states that this may happen, unless you're in an area where the legal basis for this sort of inspection is weaker. Protecting people who aren't at work but are using a potentially hostile network (public WiFi, etc.) from their own device is certainly a legitimate concern.
- fiddlerwoaroof 9y ago
  Of course, this is a feature in certain contexts: I’d love to be able to inspect all the traffic going in and out of my home network and possibly even modifying it at the edge device.
  - MaulingMonkey 9y ago
    Try fiddler. I've inspected my own HTTPS traffic a number of times using it including e.g. traffic from e.g. iPads where my Desktop was effectively acting as "the edge device". Of course, this is more for debugging than aggregate statistics/monitoring... This won't let you inspect traffic secured via certificate pinning without additional reverse engineering to figure out how to replace the pinned cert, but it'll work fine for vanilla HTTPS / generic CA based stuff (e.g. all browser traffic.)
    - IncRnd 9y ago
saas_co_de 9y ago
> It solves a problem, but it's not a big problem Exactly. In the overall threat landscape that computer users face using HTTPS for cat videos and blog posts is meaningless. Everyone who needs HTTPS already implemented it and any individual user who actually cares about security can use a VPN.
- dane-pgp 9y ago
  Are you proposing that Chrome drop the security warning if it detects that the user is visiting a site that only has cat videos or blog posts on? Do you realise that people have been arrested for writing blog posts?
  - anonymfus 9y ago
    Not only for writing, but also for sharing/reposting/liking/upvoting.

brucephillips 9y ago

The ability for third parties to sniff your traffic is a big problem.

ams6110 9y ago
It's not a big problem if the traffic is inconsequential. If I'm passively browsing I don't really care too much. If I'm submitting forms, or working in a authenticated session, that's a different matter of course. And as easy as it is to get a certificate these days, what does it really prove? It stops 3rd party snooping, but then again so does a self-signed certificate.
- niij 9y ago
  I think you're confusing authentication vs encryption. If you were MITMing someone and using a self signed cert for example.com that connection can be encrypted (if the user clicks through the warnings) but says nothing about your trust for the site.
  - ams6110 9y ago
    Let's Encrypt, or any other low-cost SSL certificate, says very little about my trust for the site either. It's just too easy to get them to think they really mean anything.
    - dragonwriter 9y ago
      An expensive DV certificate doesn't really say any more than a cheap one, except that the person buying it had money to burn. Whether an EV certificate should do much more for trust than DV is a matter of some debate.
    - tialaramex 9y ago
      All new certificates for DNS names in the Web PKI today (and for some time now) must result from the CA having used one of the Ten Blessed Methods to validate the Applicants control over the name, regardless of who paid how much. Let's Encrypt offered three of the Ten, but one was discovered to be flawed due to the way some major bulk hosting services are configured, so that leaves two (of Nine, since in practice any implementation of the Tenth Blessed Method is flawed the same way). Even flawed Blessed Methods are far superior to the checking (basically none) we can reasonably expect from a normal person using a web browser. But still, improvements upon the Blessed Methods are a topic of public discussion, if you think you genuinely have a better way you should definitely let the CA/B Forum or m.d.s.policy know about it.
    - niij 9y ago
      Having any valid cert (DV or otherwise) proves that you are viewing the example.com that the owner of example.com wants you to see. Without a certificate, you can/will be MITMed. >It's just too easy to get them to think they really mean anything. I'm not sure what you mean by this: 1. Are you saying that there is a vulnerability where you can get a valid certificate for a domain you don't own? 2. Do you mean the fact that valid owners of a domain can get a certificate easily? If 1, please provide more info. If 2, why is that a bad thing?
- lolsal 9y ago
  The traffic is only inconsequential until it's not. It's a privacy matter, not strictly a security matter.
  - deleted 9y ago
    [deleted]
jlarocco 9y ago
That's simply not true. 99% of the time I could care less if a middle man sniffs my traffic. HTTPS is for that other 1% of the time. The hypocrisy here is amazing, too, because while pushing HTTPS, Google itself is actively following everybody around, tracking everything they do online.
- brucephillips 9y ago
  Blackmail, economic exploitation, political repercussions including imprisonment are all real consequences of surveillence.
  - jlarocco 9y ago
    I'd like to see something comparing the number of people blackmailed or exploited by sniffed HTTP traffic versus the number of people affected by back end exploits or social engineering. Everybody screams about HTTPS because it's easy to do, but it's a tiny problem in the grand scheme of things, and it gives people a misplaced sense of security.
    - dane-pgp 9y ago
      To be fair, there's not much that browser makers can do about back end exploits and social engineering. Google aren't in the business of writing back ends for third parties, and it's difficult to know if a website's back end is insecure, so I don't know who you expect to hear "scream", or who they would scream about. The article is about one practical measure that a browser maker has taken to improve the piece of user-facing software that they are responsible for, and some users of that software are applauding this improvement. Having said that, I do accept your over all point that there is a lot of other work that still needs to be done in securing the web. As you suggest, that's not going to be easy, but let's not fail to fix the things that we can fix already.
- Diederich 9y ago
  https is about two big things in my mind. The obvious one is that it makes your traffic hard or impossible to sniff. What's often overlooked is that it also makes your session highly resistant to tampering by 3rd parties. These parties include: 1. Anybody who might have access to your home WIFI network. 2. Your Internet Service Provider. There's been plenty of documented cases where ISPs have injected 'harmless' HTML. 3. Any number of bad actors if you're using any kind of public WIFI. 4. National actors. That's the NSA in the United States, where we have clear evidence that they have been capable of intercepting unsecured connections and injecting unreleased attacks into targeted computers. This is not tinfoil hat stuff. The benefit of https is undeniably greater than the cost. I'm not crazy about how Google throws their weight around in a lot of cases either. But in this case, I think they're doing the right thing.
takeda 9y ago
The real reason for Google pushing this is is due to ISPs having genius idea of start replacing ads on sites with their own. Google is not doing this without interest, but I guess it overall is beneficial for us as well...

paulie_a 9y ago

It is a huge problem

dingo_bat 9y ago

I agree. Nobody is attacked using MITM, which is the only thing HTTPS prevents. Most credential leaks are due to insufficient security at the server, not the connection.

jsmthrowaway 9y ago
> Nobody is attacked using MITM, which is the only thing HTTPS prevents The only thing? I can think of four others off hand. That said, the “only” thing is pretty important in itself.
- dingo_bat 9y ago
  It's not important at all for most people. How many times have you been MITM'd? I'll tell you about me: zero. Nobody cares enough about me to do that. You know what people get bitten by? Hacked servers where the whole website is under a phisher's control or malicious website which downloads malware to your machine or sells your data (eg, Google, Facebook). Maybe my knowledge is lacking, so please tell me what those 4 things are that you're being so elusive about. I suspect they are also as unlikely as MITM.
  - roblabla 9y ago
    I've been MITM'd numerous time in the past. I've been MITM by corporate netorks filtering my traffic. I've been MITM'd by scummy and public wifi hotspots trying to inject ads. My own domain provider once MITM'd my domain in a weird attempt to tell me my domain was expiring... I'm not trying to protect myself from a targeted attack. I'm trying to protect myself from the enormous amount of scummy behavior in this whole industry. When I connect to my bank, I want my data to be secure not only against malicious activity, but negligence and incompetence. This is the threat model that HTTPS-Everywhere protects against. Sure, people get bitten by viruses and phishes. But let's fix things one step at a time.
    - dingo_bat 9y ago
      > When I connect to my bank, I want my data to be secure not only against malicious activity, but negligence and incompetence. What bank do you use that doesn't use https already? Maybe it's time to change your bank rather than force every website in the world to switch to https.

jdavis703 9y ago

Man in the middle attacks are more common than you'd think. Many corporate networks inspect outbound network traffic. I've heard of some coffee shop WiFi spots that also modify traffic to inject ads. Having someone tamper with your traffic, is a big deal. Especially consider many websites people visit are sensitive in nature, e.g. Google almost certainty knows more about me than any other human being -- they might even know more about me than I know about myself.

Silhouette 9y ago
Most corporate networks are going to inspect or block HTTPS traffic too. They have security and regulatory compliance concerns, and consequently deploying tools capable of intercepting that traffic is pretty much the norm these days. It's all but certain that if you have a work PC then your contract/handbook/etc. states that this may happen, unless you're in an area where the legal basis for this sort of inspection is weaker. Protecting people who aren't at work but are using a potentially hostile network (public WiFi, etc.) from their own device is certainly a legitimate concern.
fiddlerwoaroof 9y ago
Of course, this is a feature in certain contexts: I’d love to be able to inspect all the traffic going in and out of my home network and possibly even modifying it at the edge device.
- MaulingMonkey 9y ago
  Try fiddler. I've inspected my own HTTPS traffic a number of times using it including e.g. traffic from e.g. iPads where my Desktop was effectively acting as "the edge device". Of course, this is more for debugging than aggregate statistics/monitoring... This won't let you inspect traffic secured via certificate pinning without additional reverse engineering to figure out how to replace the pinned cert, but it'll work fine for vanilla HTTPS / generic CA based stuff (e.g. all browser traffic.)
  - IncRnd 9y ago

saas_co_de 9y ago

> It solves a problem, but it's not a big problem Exactly. In the overall threat landscape that computer users face using HTTPS for cat videos and blog posts is meaningless. Everyone who needs HTTPS already implemented it and any individual user who actually cares about security can use a VPN.

dane-pgp 9y ago
Are you proposing that Chrome drop the security warning if it detects that the user is visiting a site that only has cat videos or blog posts on? Do you realise that people have been arrested for writing blog posts?
- anonymfus 9y ago
  Not only for writing, but also for sharing/reposting/liking/upvoting.