8 ms·

> I hate that I have to just because all you mofo's have forced me. I can't empathize with this perspective. "Encrypt every packet with strong cryptography" i

> I hate that I have to just because all you mofo's have forced me. I can't empathize with this perspective. "Encrypt every packet with strong cryptography" is the mission statement of the information security community ever since Edward Snowden went public. The "mofos" have "forced" you to protect your users from attacks like QUANTUMINSERT. The "mofos" have "forced" you to protect your users from abusive ISPs injecting advertisements that track them into web pages that gain no revenue from these ads. The "mofos" have "forced" you to protect your users from being hit with increased malvertising and watering hole attacks because ISPs generally cannot secure their own systems. I think the wins here far outweigh the temporary inconvenience of having to install/use certbot.

dragontamer 8y ago
Okay, I'll bite. Why would strong-encryption be necessary for a video game guide web-page? Say, one about Factorio? Some game communities are toxic. IE: Minecraft guides I'd host with https due to the threat of scumbags and hackers. But Factorio's community is incredibly lax and laid-back. So I would consider HTTPS to be a waste of effort and resources.
- kerng 8y ago
  Because otherwise an ISP might insert ads, or some adversary changes the content and inserts malware. Also, as a consumer of your blog I want privacy, no need for ISP to know what I click on and read exactly. These are just a few reasons why.
  - dragontamer 8y ago
    > Also, as a consumer of your blog I want privacy, no need for ISP to know what I click on and read exactly. In this hypothetical example, you're clicking on a video game guide. Someone watching you buy games from Gamestop would have more information than someone watching you click on "How Factorio Trains Work" or something else on this hypothetical example. If the reverse DNS points to the IP address of the blog (ie: people see that you're browsing "FactorioGuide.com"), they're gonna figure out that you're learning how to play the game Factorio in any case. Even if all the traffic were encrypted. The only way people don't know what you're doing is if the guide were on a shared host with many-many webpages on a singular IP Address. But otherwise, the typical website (ie: self-hosted on a VPS) would have a unique IP Address and a unique reverse-DNS entry. And people would figure out how long you've been browsing and what you've been looking at, even through HTTPS.
    - comex 8y ago
      If the site is using Cloudflare (free), AWS CloudFront (cheap), or another CDN, it won't have a unique IP address. For now, the domain name will still leak in plaintext through DNS and over the TLS connection in the SNI field, but browsers are planning to implement DNS over HTTPS [1], and encrypted SNI is on the way [2]. [1] https://blog.nightly.mozilla.org/2018/06/01/improving-dns-privacy-in-firefox/ https://blog.nightly.mozilla.org/2018/06/01/improving-dns-pr... [2] https://news.ycombinator.com/item?id=17401509 https://news.ycombinator.com/item?id=17401509
- crunchatized 8y ago
  All 3 of the concerns GP listed are completely agnostic to the topic of the web page or the behavior of its audience. It's not your fellow webpage visitors or community that are most likely to be in a position in the network to be doing MITM attacks.
- jonafato 8y ago
  ISPs and other network operators are notorious for injecting content into webpages [0]. Even if someone is doing this for "harmless" or even "benevolent" reasons, someone else is cryptocurrency mining, tracking, nefariously manipulating content, etc. [0]: https://thenextweb.com/insights/2017/12/11/comcast-continues-to-inject-its-own-code-into-websites-you-visit/ https://thenextweb.com/insights/2017/12/11/comcast-continues...
- filleduchaos 8y ago
  You're asking the wrong question, like many others who are resistant to HTTPS everywhere. HTTPS isn't for you, the site owner (although you gain the not insignificant benefit of knowing your content and traffic is untampered with). It's for the people that visit your site, so when you say HTTPS is a waste of effort and resources what you're inadvartently saying is that you don't give a fuck about your visitors - or at least, not enough of one to do the least you can to protect them from people who want to track and/or tamper with their browsing activity[1]. Especially since solutions like Let's Encrypt with certbot are free and take a couple of commands to set up. [1] Unencrypted, pretty much everything about your internet traffic is laid bare for any middleman - your ISP, the person who controls the router you're connected to, some script kiddie on the same network as you - to both read and write. Injecting ads or cryptominers, tracking what pages you visit, changing what a page says, even straight up serving a different page. Why let your site/server be a (potential) vehicle for exploitation, disinformation and privacy invasion?
  - dragontamer 8y ago
    If the user is so paranoid about this sort of stuff, then they can go get a VPS and control a large chunk of the network for themselves. For everyone else, its a game guide. The worst that can happen is that they get the wrong information about how Trains work in Factorio. There wouldn't be a need for me to track users or clicks or whatever in a hypothetical game guide community website. As I stated before: I know some game communities (ie: Minecraft or Eve Online) can be toxic. But the Factorio community isn't like that. So I'd be comfortable hosting a Factorio webpage under HTTP. If I were hosting a Minecraft or Eve webpage however (warning: toxic community ahead), then I'd host it under HTTPS due to the dastards who troll and harass others in that community. ---------- That's the more important part btw: understanding your audience. Some game communities are toxic and full of harassers, trolls and so forth. But other communities are lax, friendly, and can get away with lesser amounts of security.
    - supertrope 8y ago
      The worst that can happen is malware Javascript, phishing re-directs are injected. Of course if the page itself has ad networks those are there by design.
- gmiller123456 8y ago
  There's really not a need to. Others have pointed out that your ISP might inject ads, or something similar, another thing is encrypting only the traffic you want to keep secret leaks information about the fact that you're doing something you want to keep secret. These are not issues that are likely cause great damage, so no, there is no need to encrypt every last bit of traffic. But the bigger question is "Why wouldn't you encrypt it"? There's really not a lot of reasons not to.
  - dragontamer 8y ago
    Your argument, out of everyone else's, is the most sane. So lemme point this out: > But the bigger question is "Why wouldn't you encrypt it"? You're right. There's not a lot of good reasons I can think of. The best argument I've been able to come up with is ISP-level caching of HTTP traffic, which may save on bandwidth. But my host doesn't even charge for the measly amounts of bandwidth I use, so that's certainly not a concern. Modern servers have HTTPS hardware-acceleration in the form of AES-NI, so it doesn't even use much more CPU power to use TLS these days. So really, bandwidth savings from ISP-level caching is the best counter-argument I've got. Which is to say: not a very big concern of mine.
- ozim 8y ago
  Okay, I am going to make free hotspot that serves your site as default starting page but with javascript malware downloader. All people will assume that your page is installing malware on their hardware. Non tech people will not understand that was this free hotspot. Now move a bit further, someone at ISP or network somewhere in world injects malware only into traffic of your page. I visited your page I got malware installed or my AV started alarms. Would they know that was not your site serving malware?
  - dragontamer 8y ago
    But you could do that under HTTPS, with a self-signed certificate and have it load under HTTPS anyway. Or a variety of methods to get an illegitimate certificate trusted to some subset of users.
    - UncleMeat 8y ago
      But I can't do that in the moment. Without HTTPS I sit on the network and see a clear request to your website. I intercept it and cause problems. With HTTPS I need to have planned ahead of time to target your website specifically and spent time and money on getting a bogus cert for your website. If your website is small I am not likely to do that. But I don't care how big your website is once I'm seeing cleartext traffic.
      - dragontamer 8y ago
        Hmm, well, in this case its as easy as running a script and clicking a button from this particular host. So I guess there's no major reason why not to do it (and it seems like my provider is defaulting to TLS from Lets Encrypt on any new sites made anyway). So its the new default way of doing things. I'm not entirely convinced that it solves the MITM attack still. But I'm still not convinced that the arguments a lot of people are making around here necessarily make sense either. A lot of these attacks are fundamentally theoretical and don't seem broadly applicable. The main argument that convinced me is: its easy to do, so why not? But the scare tactics that a lot of people in this discussion are unsavory to me and are unintelligent IMO.
strictnein 8y ago
> "I think the wins here far outweigh the temporary inconvenience of having to install/use certbot." Installing certbot isn't something you can do on 100% of hosts. Switching hosts is also a pain.
- Sir_Cmpwn 8y ago
  I challenge you to find a host you can't install this on: https://github.com/kristapsdz/acme-client-portable https://github.com/kristapsdz/acme-client-portable If you bring up that you don't control the host (shared hosting), then we should shame the shared hosting provider, who has no excuse.
  - supermdguy 8y ago
    Heroku free dynos: https://devcenter.heroku.com/articles/ssl https://devcenter.heroku.com/articles/ssl
    - Sir_Cmpwn 8y ago
      https://devcenter.heroku.com/articles/automated-certificate-management https://devcenter.heroku.com/articles/automated-certificate-...
      - supermdguy 8y ago
        "Heroku automatically manages TLS certificates for apps with Hobby and Professional dynos". It doesn't support free dynos.
        Sir_Cmpwn 8y ago
        Then as I said: shame on Heroku.
        CiPHPerCoder 8y ago
        You get to choose your own adventure here. > Ask Heroku to support LetsEncrypt on all dynos. > Vote with your wallets and move away from Heroku. > Launch a competitor that allows others to move away from Heroku. > _

dragontamer 8y ago

Okay, I'll bite. Why would strong-encryption be necessary for a video game guide web-page? Say, one about Factorio? Some game communities are toxic. IE: Minecraft guides I'd host with https due to the threat of scumbags and hackers. But Factorio's community is incredibly lax and laid-back. So I would consider HTTPS to be a waste of effort and resources.

kerng 8y ago
Because otherwise an ISP might insert ads, or some adversary changes the content and inserts malware. Also, as a consumer of your blog I want privacy, no need for ISP to know what I click on and read exactly. These are just a few reasons why.
- dragontamer 8y ago
  > Also, as a consumer of your blog I want privacy, no need for ISP to know what I click on and read exactly. In this hypothetical example, you're clicking on a video game guide. Someone watching you buy games from Gamestop would have more information than someone watching you click on "How Factorio Trains Work" or something else on this hypothetical example. If the reverse DNS points to the IP address of the blog (ie: people see that you're browsing "FactorioGuide.com"), they're gonna figure out that you're learning how to play the game Factorio in any case. Even if all the traffic were encrypted. The only way people don't know what you're doing is if the guide were on a shared host with many-many webpages on a singular IP Address. But otherwise, the typical website (ie: self-hosted on a VPS) would have a unique IP Address and a unique reverse-DNS entry. And people would figure out how long you've been browsing and what you've been looking at, even through HTTPS.
  - comex 8y ago
    If the site is using Cloudflare (free), AWS CloudFront (cheap), or another CDN, it won't have a unique IP address. For now, the domain name will still leak in plaintext through DNS and over the TLS connection in the SNI field, but browsers are planning to implement DNS over HTTPS [1], and encrypted SNI is on the way [2]. [1] https://blog.nightly.mozilla.org/2018/06/01/improving-dns-privacy-in-firefox/ https://blog.nightly.mozilla.org/2018/06/01/improving-dns-pr... [2] https://news.ycombinator.com/item?id=17401509 https://news.ycombinator.com/item?id=17401509
crunchatized 8y ago
All 3 of the concerns GP listed are completely agnostic to the topic of the web page or the behavior of its audience. It's not your fellow webpage visitors or community that are most likely to be in a position in the network to be doing MITM attacks.
jonafato 8y ago
ISPs and other network operators are notorious for injecting content into webpages [0]. Even if someone is doing this for "harmless" or even "benevolent" reasons, someone else is cryptocurrency mining, tracking, nefariously manipulating content, etc. [0]: https://thenextweb.com/insights/2017/12/11/comcast-continues-to-inject-its-own-code-into-websites-you-visit/ https://thenextweb.com/insights/2017/12/11/comcast-continues...
filleduchaos 8y ago
You're asking the wrong question, like many others who are resistant to HTTPS everywhere. HTTPS isn't for you, the site owner (although you gain the not insignificant benefit of knowing your content and traffic is untampered with). It's for the people that visit your site, so when you say HTTPS is a waste of effort and resources what you're inadvartently saying is that you don't give a fuck about your visitors - or at least, not enough of one to do the least you can to protect them from people who want to track and/or tamper with their browsing activity[1]. Especially since solutions like Let's Encrypt with certbot are free and take a couple of commands to set up. [1] Unencrypted, pretty much everything about your internet traffic is laid bare for any middleman - your ISP, the person who controls the router you're connected to, some script kiddie on the same network as you - to both read and write. Injecting ads or cryptominers, tracking what pages you visit, changing what a page says, even straight up serving a different page. Why let your site/server be a (potential) vehicle for exploitation, disinformation and privacy invasion?
- dragontamer 8y ago
  If the user is so paranoid about this sort of stuff, then they can go get a VPS and control a large chunk of the network for themselves. For everyone else, its a game guide. The worst that can happen is that they get the wrong information about how Trains work in Factorio. There wouldn't be a need for me to track users or clicks or whatever in a hypothetical game guide community website. As I stated before: I know some game communities (ie: Minecraft or Eve Online) can be toxic. But the Factorio community isn't like that. So I'd be comfortable hosting a Factorio webpage under HTTP. If I were hosting a Minecraft or Eve webpage however (warning: toxic community ahead), then I'd host it under HTTPS due to the dastards who troll and harass others in that community. ---------- That's the more important part btw: understanding your audience. Some game communities are toxic and full of harassers, trolls and so forth. But other communities are lax, friendly, and can get away with lesser amounts of security.
  - supertrope 8y ago
    The worst that can happen is malware Javascript, phishing re-directs are injected. Of course if the page itself has ad networks those are there by design.
gmiller123456 8y ago
There's really not a need to. Others have pointed out that your ISP might inject ads, or something similar, another thing is encrypting only the traffic you want to keep secret leaks information about the fact that you're doing something you want to keep secret. These are not issues that are likely cause great damage, so no, there is no need to encrypt every last bit of traffic. But the bigger question is "Why wouldn't you encrypt it"? There's really not a lot of reasons not to.
- dragontamer 8y ago
  Your argument, out of everyone else's, is the most sane. So lemme point this out: > But the bigger question is "Why wouldn't you encrypt it"? You're right. There's not a lot of good reasons I can think of. The best argument I've been able to come up with is ISP-level caching of HTTP traffic, which may save on bandwidth. But my host doesn't even charge for the measly amounts of bandwidth I use, so that's certainly not a concern. Modern servers have HTTPS hardware-acceleration in the form of AES-NI, so it doesn't even use much more CPU power to use TLS these days. So really, bandwidth savings from ISP-level caching is the best counter-argument I've got. Which is to say: not a very big concern of mine.
ozim 8y ago
Okay, I am going to make free hotspot that serves your site as default starting page but with javascript malware downloader. All people will assume that your page is installing malware on their hardware. Non tech people will not understand that was this free hotspot. Now move a bit further, someone at ISP or network somewhere in world injects malware only into traffic of your page. I visited your page I got malware installed or my AV started alarms. Would they know that was not your site serving malware?
- dragontamer 8y ago
  But you could do that under HTTPS, with a self-signed certificate and have it load under HTTPS anyway. Or a variety of methods to get an illegitimate certificate trusted to some subset of users.
  - UncleMeat 8y ago
    But I can't do that in the moment. Without HTTPS I sit on the network and see a clear request to your website. I intercept it and cause problems. With HTTPS I need to have planned ahead of time to target your website specifically and spent time and money on getting a bogus cert for your website. If your website is small I am not likely to do that. But I don't care how big your website is once I'm seeing cleartext traffic.
    - dragontamer 8y ago
      Hmm, well, in this case its as easy as running a script and clicking a button from this particular host. So I guess there's no major reason why not to do it (and it seems like my provider is defaulting to TLS from Lets Encrypt on any new sites made anyway). So its the new default way of doing things. I'm not entirely convinced that it solves the MITM attack still. But I'm still not convinced that the arguments a lot of people are making around here necessarily make sense either. A lot of these attacks are fundamentally theoretical and don't seem broadly applicable. The main argument that convinced me is: its easy to do, so why not? But the scare tactics that a lot of people in this discussion are unsavory to me and are unintelligent IMO.

strictnein 8y ago

> "I think the wins here far outweigh the temporary inconvenience of having to install/use certbot." Installing certbot isn't something you can do on 100% of hosts. Switching hosts is also a pain.

Sir_Cmpwn 8y ago
I challenge you to find a host you can't install this on: https://github.com/kristapsdz/acme-client-portable https://github.com/kristapsdz/acme-client-portable If you bring up that you don't control the host (shared hosting), then we should shame the shared hosting provider, who has no excuse.
- supermdguy 8y ago
  Heroku free dynos: https://devcenter.heroku.com/articles/ssl https://devcenter.heroku.com/articles/ssl
  - Sir_Cmpwn 8y ago
    https://devcenter.heroku.com/articles/automated-certificate-management https://devcenter.heroku.com/articles/automated-certificate-...
    - supermdguy 8y ago
      "Heroku automatically manages TLS certificates for apps with Hobby and Professional dynos". It doesn't support free dynos.
      - Sir_Cmpwn 8y ago
        Then as I said: shame on Heroku.
      - CiPHPerCoder 8y ago
        You get to choose your own adventure here. > Ask Heroku to support LetsEncrypt on all dynos. > Vote with your wallets and move away from Heroku. > Launch a competitor that allows others to move away from Heroku. > _