5 ms·

> IMHO, They should rename the S in HTTPS to $. This is an absurd thing to say when Let's Encrypt exists.

ksk 9y ago
Why is it absurd? So I either have to pay a CA vendor, or I have to ask Lets Encrypt permission to renew my cert every 90 days. In any case, why should I be forced to support a model where I have to beg for permission to host anything. I believe in stating my opinions and let others make up their own mind. The opposition believes in forcing everyone to adopt their position by fiat. Why not put the information out there, and let people switch to HTTPS if they feel like the benfits make sense to them.
- dragonwriter 9y ago
  You aren't forced to do anything. If you choose to use HTTP, you can, and no one will stop you. The Chrome omnibox will accurately report to users that your site is insecure, if you do, but that's just making them aware of a basic fact.
  - ksk 9y ago
    >The Chrome omnibox will accurately report to users that your site is insecure What evidence does Chrome have that my site is insecure or poses a threat to users? 'What could happen' logic would mean disabling all browsers since you could get pwned by using any of them. That is not a rational way to approach anything.
    - dragonwriter 9y ago
      > What evidence does Chrome have that my site is insecure The fact that it is using HTTP, and therefore can be trivially MITMed by anyone controlling any point traversed between you and the client. Communication between the browser and your server is insecure. Whether that is an important fact to users is a decision users will need to make, but it is a fact. > 'What could happen' logic would mean disabling all browsers since you could get pwned by using any of them. Clearly, to the extent that is accurate, that's not the logic at issue since nothing is being disabled here. So, please, stop with the irrelevant strawmen.
      - ksk 9y ago
        >The fact that it is using HTTP, and therefore can be trivially MITMed by anyone controlling any point traversed between you and the client. Can you please link to any evidence showing the millions of HTTP sites that were MITMed? I mean after all its so trivial as you claim. OTOH, why would anyone care to do that when they've found it much easier to trivially inject scripts and other potentially harmful stuff via compromised ads, third party hosted JS scripts, compromised CDNs, etc, etc. The current proposal fails to address any of those real, actual, tangible 'bad' things that are actually occuring with alarming frequency. >Communication between the browser and your server is insecure. That applies to every single piece of data transfered that is not under the control of the domain being visited. >Clearly, to the extent that is accurate, that's not the logic at issue since nothing is being disabled here. So, please, stop with the irrelevant strawmen. Simply asserting it doesn't make it so. I reject your interpretation. The most dominant browser vendor showing scrary yellow triangles with exclamation marks, instead of showing your webpage is exactly like disabling it.
        dragonwriter 9y ago
        > The most dominant browser vendor showing scrary yellow triangles with exclamation marks, instead of showing your webpage is exactly like disabling it. No, it'd not, and we know it's not because the much more forceful click-through warnings they used for HTTPS certificate errors (because scary red icons in the address bar failed) still had a high enough click-through rate when the “proceed” link wasn't hidden behind a multi-click process hidden behind an “advanced” button that, well, they invented the multistep, hidden process they use now for certificate errors. And, anyway, the UI they've shown is simple light grey “Not Secure” text, not a “scary yellow triangle”. It's not anything like blocking, and it's not a blocking attempt that failed because—frommthr experience with certificate errors—they know how much it takes to really stop casual web users from proceeding in the face of a security warning.
        ric2b 9y ago
        > Can you please link to any evidence showing the millions of HTTP sites that were MITMed? Pretty much every single one, when accessed from a hotel or public wi-fi network that injects ads into pages?
- Faark 9y ago
  > Why not put the information out there And that's why chrome will mark your site as insecure. > why should I be forced to [..] beg for permission [..] That seems to be the best thing humans came up with so far, if you want nice stuff that requires coordination. You also have to "beg" for a connection & ip address. You also have to "beg" for a DNS name. Please propose something better (that doesn't come with its own significant drawbacks).
  - ksk 9y ago
    >And that's why chrome will mark your site as insecure. That is a false statement. Using 'what could happen' logic, Windows should label Chrome/Firefox/IE as insecure/malware since someone could theoretically do bad things with those tools. >Please propose something better (that doesn't come with its own significant drawbacks). Why don't you start first? Since this HTTPS so-called 'solution' has its own significant drawbacks.
- wishinghand 9y ago
  It's absurd because you're describing it as some sort of money shakedown when 1) Google isn't profiting off of this and 2) you can get certificates for free.
  - romwell 9y ago
    The complaint is not about the cost of the certificate, it's about handing the control to availability to someone else. What you are describing is how things are working for now. First, there's now guarantee Let's Encrypt will be here tomorrow. You're pinning the future of the Internet onto the shoulders of maybe a dozen people who run it. Second, CA's are - by definition - centralized. There's no guarantee that, in principle, you'll always be able to get a certificate for them. The Internet was designed to be distributed and hard to break. HTTPS-only Internet is going backwards on this. I'm all for security and privacy, but any solution that requires a centralized third-party for the whole system to function is, in my opinion, broken by design. There's that, and there's making the system needlessly complicated for many tasks. There are very, very many websites and users (I'd say - the absolute majority) who are OK with the Dangers Of HTTP (that is, some intermediate party being aware that you read a certain webpage). Worrying about that in the age where every step is tracked, every face detected, and every page is full of trackers seems, to me, facetious.

ksk 9y ago

Why is it absurd? So I either have to pay a CA vendor, or I have to ask Lets Encrypt permission to renew my cert every 90 days. In any case, why should I be forced to support a model where I have to beg for permission to host anything. I believe in stating my opinions and let others make up their own mind. The opposition believes in forcing everyone to adopt their position by fiat. Why not put the information out there, and let people switch to HTTPS if they feel like the benfits make sense to them.

dragonwriter 9y ago
You aren't forced to do anything. If you choose to use HTTP, you can, and no one will stop you. The Chrome omnibox will accurately report to users that your site is insecure, if you do, but that's just making them aware of a basic fact.
- ksk 9y ago
  >The Chrome omnibox will accurately report to users that your site is insecure What evidence does Chrome have that my site is insecure or poses a threat to users? 'What could happen' logic would mean disabling all browsers since you could get pwned by using any of them. That is not a rational way to approach anything.
  - dragonwriter 9y ago
    > What evidence does Chrome have that my site is insecure The fact that it is using HTTP, and therefore can be trivially MITMed by anyone controlling any point traversed between you and the client. Communication between the browser and your server is insecure. Whether that is an important fact to users is a decision users will need to make, but it is a fact. > 'What could happen' logic would mean disabling all browsers since you could get pwned by using any of them. Clearly, to the extent that is accurate, that's not the logic at issue since nothing is being disabled here. So, please, stop with the irrelevant strawmen.
    - ksk 9y ago
      >The fact that it is using HTTP, and therefore can be trivially MITMed by anyone controlling any point traversed between you and the client. Can you please link to any evidence showing the millions of HTTP sites that were MITMed? I mean after all its so trivial as you claim. OTOH, why would anyone care to do that when they've found it much easier to trivially inject scripts and other potentially harmful stuff via compromised ads, third party hosted JS scripts, compromised CDNs, etc, etc. The current proposal fails to address any of those real, actual, tangible 'bad' things that are actually occuring with alarming frequency. >Communication between the browser and your server is insecure. That applies to every single piece of data transfered that is not under the control of the domain being visited. >Clearly, to the extent that is accurate, that's not the logic at issue since nothing is being disabled here. So, please, stop with the irrelevant strawmen. Simply asserting it doesn't make it so. I reject your interpretation. The most dominant browser vendor showing scrary yellow triangles with exclamation marks, instead of showing your webpage is exactly like disabling it.
      - dragonwriter 9y ago
        > The most dominant browser vendor showing scrary yellow triangles with exclamation marks, instead of showing your webpage is exactly like disabling it. No, it'd not, and we know it's not because the much more forceful click-through warnings they used for HTTPS certificate errors (because scary red icons in the address bar failed) still had a high enough click-through rate when the “proceed” link wasn't hidden behind a multi-click process hidden behind an “advanced” button that, well, they invented the multistep, hidden process they use now for certificate errors. And, anyway, the UI they've shown is simple light grey “Not Secure” text, not a “scary yellow triangle”. It's not anything like blocking, and it's not a blocking attempt that failed because—frommthr experience with certificate errors—they know how much it takes to really stop casual web users from proceeding in the face of a security warning.
      - ric2b 9y ago
        > Can you please link to any evidence showing the millions of HTTP sites that were MITMed? Pretty much every single one, when accessed from a hotel or public wi-fi network that injects ads into pages?
Faark 9y ago
> Why not put the information out there And that's why chrome will mark your site as insecure. > why should I be forced to [..] beg for permission [..] That seems to be the best thing humans came up with so far, if you want nice stuff that requires coordination. You also have to "beg" for a connection & ip address. You also have to "beg" for a DNS name. Please propose something better (that doesn't come with its own significant drawbacks).
- ksk 9y ago
  >And that's why chrome will mark your site as insecure. That is a false statement. Using 'what could happen' logic, Windows should label Chrome/Firefox/IE as insecure/malware since someone could theoretically do bad things with those tools. >Please propose something better (that doesn't come with its own significant drawbacks). Why don't you start first? Since this HTTPS so-called 'solution' has its own significant drawbacks.
wishinghand 9y ago
It's absurd because you're describing it as some sort of money shakedown when 1) Google isn't profiting off of this and 2) you can get certificates for free.
- romwell 9y ago
  The complaint is not about the cost of the certificate, it's about handing the control to availability to someone else. What you are describing is how things are working for now. First, there's now guarantee Let's Encrypt will be here tomorrow. You're pinning the future of the Internet onto the shoulders of maybe a dozen people who run it. Second, CA's are - by definition - centralized. There's no guarantee that, in principle, you'll always be able to get a certificate for them. The Internet was designed to be distributed and hard to break. HTTPS-only Internet is going backwards on this. I'm all for security and privacy, but any solution that requires a centralized third-party for the whole system to function is, in my opinion, broken by design. There's that, and there's making the system needlessly complicated for many tasks. There are very, very many websites and users (I'd say - the absolute majority) who are OK with the Dangers Of HTTP (that is, some intermediate party being aware that you read a certain webpage). Worrying about that in the age where every step is tracked, every face detected, and every page is full of trackers seems, to me, facetious.