6 ms·

Exactly. Browser makers (including Mozilla/Firefox to a large degree) are responsible for the fact that HTTPS hasn't become the standard protocol as it should h

by Udo 16y ago

Exactly. Browser makers (including Mozilla/Firefox to a large degree) are responsible for the fact that HTTPS hasn't become the standard protocol as it should have been years ago. It's not only the unproductive mixed content warning but also the insistence of all browsers to only accept expensively bought certificates and throw a very scary and hard to overcome error dialog if a site uses any other kind of cert. While that isn't a problem for big(gish) commercial sites like GitHub, it presents an insurmountable hurdle for private sites and small-time projects for no good reason. For most sites I don't need "secure" origin verification as badly as encryption. The lack of a verifiable server address shouldn't mean that I should be bullied to not use an encrypted connection with it. But even if the verdict is that you absolutely can't have one without the other, browser makers should AT LEAST include trusted root certs of authorities who offer free SSL certificates, too.

al_james 16y ago
Hmmm... I see what you are saying, but (for example) godaddy offer basic SSL certs for $10. Not a huge price for anyone.
kijinbear 16y ago
While your frustration is understandable, I think you're speaking from the perspective of a tech-savvy person and not the average user. If browsers began accepting all free / self-signed certificates, it would be only a matter of time before something like "Firesheep FX" came along and permitted random strangers to MITM anybody's SSL session. Some of us can notice when that happens, but most people won't have a clue unless the browser presented them with a big scary red warning. However, I agree with you that we need some good free CAs. The difference between free and $10/year is bigger than most of us think it is. Fortunately, there are registrars such as Gandi which will give you free certificates with every domain.
- Udo 16y ago
  > If browsers began accepting all free / self-signed certificates [...] Right now, browsers are accepting any unencrypted old HTTP connection without any warning, while non-verified securely encrypted connections are actively prevented. Tech people can circumvent the block, but normal users cannot. Nor do they have any reason to because the warning they are being shown sounds like the end of the world, while any unsecured connection looks perfectly fine to them. This is something that could be done right now to make everybody more secure, at no cost, but it threatens the business model of companies like Verisign. Nobody is suggesting that browser makers should display the much-sought-after "lock of absolute protection" icon on any random SSL connection, I'd be fine if they reserve that for paid-for-certs. I'm merely suggesting they show free (or even self-signed) certs the same courtesy as basic HTTP, the most permissive protocol of all time, instead of actively preventing users from using encryption. I agree with you about the threat of "Firesheep FX" and believe Wifi connections should probably all use WPA2, even at coffee shops where internet access is free. The threat of MITM is real, but the attack can be made more difficult using a number of schemes, and it even includes free certs that offer way more protection than any unencrypted link ever could. Yet, we are currently encouraging unencrypted connections while actively blocking encrypted ones. If HTTPS could have the same UI mechanisms as, say, an SSH connection I'm convinced the online world would be a much safer place.
  - nikcub 16y ago
    Wifi connections should probably all use WPA2, even at coffee shops if you just write the password on the wall, it defeats the purpose - everyone who logs in is on the same network again, just like a public network
    - deleted 16y ago
      [deleted]
    - eru 16y ago
      Everyone being on the same network isn't too much of a problem. They still can't read each others traffic. See http://en.wikipedia.org/wiki/IEEE_802.11i-2004 http://en.wikipedia.org/wiki/IEEE_802.11i-2004 or http://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#WPA2 http://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#WPA2 Every device negotiates its own keys with the access point.
      - hannibalhorn 16y ago
        Very common misconception, but it's still a problem. Any client with the network password can capture the initial key negotiation, and then decrypt the client's subsequent traffic. You can enter the network password in Wireshark: http://wiki.wireshark.org/HowToDecrypt802.11 http://wiki.wireshark.org/HowToDecrypt802.11 .
        pmjordan 16y ago
        If the shared key is known, it's also trivial to install a rogue access point with the same SSID and a transparent, tampering proxy without a realistic chance of anyone noticing.
        eru 16y ago
        Thanks.
      - nikcub 16y ago
        ye I should clarify and add that it means you can see the traffic. even if it is switched
- michaelhart 16y ago
  > The difference between free and $10/year is bigger than most of us think it is. > I agree with you that we need some good free CAs https://www.startssl.com/ https://www.startssl.com/ Supported by just about every browser. Entirely free. A fellow Hacker News user linked to it in a similar thread. I was impressed :)
  - kijinbear 16y ago
    Last time I checked, StartSSL was not recognized by some (slightly old) browsers. I wonder if this issue has been resolved now?
    - michaelhart 16y ago
      Their root CA was generated in 2006. In theory, any browser shipped before 2006 will not support it unless it was added (through, for example, Windows Updates).IE7+ is supported; I haven't tested (and don't care to test) IE6.
      - c00ki3s 16y ago
        About 3 years back I used them and back then ie6 didnt' work out of the box. And the windows root cert update didn't help either back then.
    - deleted 16y ago
      [deleted]
tomjen3 16y ago
Thats what I don't get, why Mozilla doesn't simply remove the root certificate for any organization which charges more than $10 for a wildcard certificate is beyond me. The verification is the same, there is no good reason it shouldn't be the same price.
caf 16y ago
StartSSL (http://www.startssl.com/?app=1 http://www.startssl.com/?app=1) provides free certificates that are browser-recognised.
- Udo 16y ago
  Thanks for the link, I didn't know them. I just tried it. I generated a certificate for a site of mine, uploaded it, changed the config and the cert was pulled by Firefox. However sadly, the authority of StartSSL was NOT recognized by Firefox. This is what it said in the egregious warning dialog: *-------.com uses an invalid security certificate. The certificate is not trusted because no issuer chain was provided. (Error code: sec_error_unknown_issuer)* StartSSL does not work for me. Unless I did something wrong, which happens from time to time. I verified that the StartSSL cert I installed was downloaded by FF, it just doesn't recognize StartCom as a trusted cert authority (apparently). Can anyone confirm this? Edit2: You guys were right, thanks! I did paste the intermediate certificate into the wrong file, my bad! It works!
  - smw 16y ago
    Off the top of my head, you probably didn't include the intermediate certificate. Read #31 on the faq: "Why does Firefox present a warning when connecting to my website?" http://www.startssl.com/?app=25 http://www.startssl.com/?app=25
  - erikano 16y ago
    If you're using nginx, check out [1] for instructions on how to get it working. [1]: http://blog.dembowski.net/2010/02/25/startssl-and-nginx/ http://blog.dembowski.net/2010/02/25/startssl-and-nginx/
- erikano 16y ago
  I've been using StartSSL for quite some time, and only wget has been unwilling to accept it (whereas curl, firefox and chrome have all accepted it): ERROR: cannot verify [site]'s certificate, issued by `/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Class 1 Primary Intermediate Server CA': Self-signed certificate encountered. To connect to [site] insecurely, use `--no-check-certificate'.
dekz 16y ago
I don't really understand why these Certificate Authorities exist and need to charge money to sign a digital certificate. Couldn't some sort of user based distributed network be used for authentication? I mean we trust compilers and code patches (which do see many eyes) that we then load onto our PCs. Why can't we trust some similar mechanism of authority that is user based.

by Udo 16y ago

al_james 16y ago

Hmmm... I see what you are saying, but (for example) godaddy offer basic SSL certs for $10. Not a huge price for anyone.

kijinbear 16y ago

While your frustration is understandable, I think you're speaking from the perspective of a tech-savvy person and not the average user. If browsers began accepting all free / self-signed certificates, it would be only a matter of time before something like "Firesheep FX" came along and permitted random strangers to MITM anybody's SSL session. Some of us can notice when that happens, but most people won't have a clue unless the browser presented them with a big scary red warning. However, I agree with you that we need some good free CAs. The difference between free and $10/year is bigger than most of us think it is. Fortunately, there are registrars such as Gandi which will give you free certificates with every domain.

Udo 16y ago
> If browsers began accepting all free / self-signed certificates [...] Right now, browsers are accepting any unencrypted old HTTP connection without any warning, while non-verified securely encrypted connections are actively prevented. Tech people can circumvent the block, but normal users cannot. Nor do they have any reason to because the warning they are being shown sounds like the end of the world, while any unsecured connection looks perfectly fine to them. This is something that could be done right now to make everybody more secure, at no cost, but it threatens the business model of companies like Verisign. Nobody is suggesting that browser makers should display the much-sought-after "lock of absolute protection" icon on any random SSL connection, I'd be fine if they reserve that for paid-for-certs. I'm merely suggesting they show free (or even self-signed) certs the same courtesy as basic HTTP, the most permissive protocol of all time, instead of actively preventing users from using encryption. I agree with you about the threat of "Firesheep FX" and believe Wifi connections should probably all use WPA2, even at coffee shops where internet access is free. The threat of MITM is real, but the attack can be made more difficult using a number of schemes, and it even includes free certs that offer way more protection than any unencrypted link ever could. Yet, we are currently encouraging unencrypted connections while actively blocking encrypted ones. If HTTPS could have the same UI mechanisms as, say, an SSH connection I'm convinced the online world would be a much safer place.
- nikcub 16y ago
  Wifi connections should probably all use WPA2, even at coffee shops if you just write the password on the wall, it defeats the purpose - everyone who logs in is on the same network again, just like a public network
  - deleted 16y ago
    [deleted]
  - eru 16y ago
    Everyone being on the same network isn't too much of a problem. They still can't read each others traffic. See http://en.wikipedia.org/wiki/IEEE_802.11i-2004 http://en.wikipedia.org/wiki/IEEE_802.11i-2004 or http://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#WPA2 http://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#WPA2 Every device negotiates its own keys with the access point.
    - hannibalhorn 16y ago
      Very common misconception, but it's still a problem. Any client with the network password can capture the initial key negotiation, and then decrypt the client's subsequent traffic. You can enter the network password in Wireshark: http://wiki.wireshark.org/HowToDecrypt802.11 http://wiki.wireshark.org/HowToDecrypt802.11 .
      - pmjordan 16y ago
        If the shared key is known, it's also trivial to install a rogue access point with the same SSID and a transparent, tampering proxy without a realistic chance of anyone noticing.
      - eru 16y ago
        Thanks.
    - nikcub 16y ago
      ye I should clarify and add that it means you can see the traffic. even if it is switched
michaelhart 16y ago
> The difference between free and $10/year is bigger than most of us think it is. > I agree with you that we need some good free CAs https://www.startssl.com/ https://www.startssl.com/ Supported by just about every browser. Entirely free. A fellow Hacker News user linked to it in a similar thread. I was impressed :)
- kijinbear 16y ago
  Last time I checked, StartSSL was not recognized by some (slightly old) browsers. I wonder if this issue has been resolved now?
  - michaelhart 16y ago
    Their root CA was generated in 2006. In theory, any browser shipped before 2006 will not support it unless it was added (through, for example, Windows Updates).IE7+ is supported; I haven't tested (and don't care to test) IE6.
    - c00ki3s 16y ago
      About 3 years back I used them and back then ie6 didnt' work out of the box. And the windows root cert update didn't help either back then.
  - deleted 16y ago
    [deleted]

tomjen3 16y ago

Thats what I don't get, why Mozilla doesn't simply remove the root certificate for any organization which charges more than $10 for a wildcard certificate is beyond me. The verification is the same, there is no good reason it shouldn't be the same price.

caf 16y ago

StartSSL (http://www.startssl.com/?app=1 http://www.startssl.com/?app=1) provides free certificates that are browser-recognised.

Udo 16y ago
Thanks for the link, I didn't know them. I just tried it. I generated a certificate for a site of mine, uploaded it, changed the config and the cert was pulled by Firefox. However sadly, the authority of StartSSL was NOT recognized by Firefox. This is what it said in the egregious warning dialog: *-------.com uses an invalid security certificate. The certificate is not trusted because no issuer chain was provided. (Error code: sec_error_unknown_issuer)* StartSSL does not work for me. Unless I did something wrong, which happens from time to time. I verified that the StartSSL cert I installed was downloaded by FF, it just doesn't recognize StartCom as a trusted cert authority (apparently). Can anyone confirm this? Edit2: You guys were right, thanks! I did paste the intermediate certificate into the wrong file, my bad! It works!
- smw 16y ago
  Off the top of my head, you probably didn't include the intermediate certificate. Read #31 on the faq: "Why does Firefox present a warning when connecting to my website?" http://www.startssl.com/?app=25 http://www.startssl.com/?app=25
- erikano 16y ago
  If you're using nginx, check out [1] for instructions on how to get it working. [1]: http://blog.dembowski.net/2010/02/25/startssl-and-nginx/ http://blog.dembowski.net/2010/02/25/startssl-and-nginx/
erikano 16y ago
I've been using StartSSL for quite some time, and only wget has been unwilling to accept it (whereas curl, firefox and chrome have all accepted it): ERROR: cannot verify [site]'s certificate, issued by `/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Class 1 Primary Intermediate Server CA': Self-signed certificate encountered. To connect to [site] insecurely, use `--no-check-certificate'.

dekz 16y ago

I don't really understand why these Certificate Authorities exist and need to charge money to sign a digital certificate. Couldn't some sort of user based distributed network be used for authentication? I mean we trust compilers and code patches (which do see many eyes) that we then load onto our PCs. Why can't we trust some similar mechanism of authority that is user based.