4 ms·

Yeah but you used to need a credit card. The barrier to entry is lower. HTTPS is a tire fire.

tazard 8y ago
Your completely right, where on Earth would criminals and scammers be able to get a credit card? /s I am having a hard time understanding how more websites using https could possibly be a worse thing.
- gregmac 8y ago
  Lots of people still have the mindset that http is the default and https signals a high level of trustworthiness. What we're shifting towards (and maybe already are there) is https is default, and an http-only site is an amateur setup, on the same level as hosting your site via IP (no domain name at all) or with a url like http://myisp.net/~mycompany/default.htm http://myisp.net/~mycompany/default.htm. Like it or not, browsers are treating sites like this now, and you don't see many "Secured by TrustworthyCo SSL" golden padlock badge images anymore.
- 3pt14159 8y ago
  Yeah, yeah. So many on HN has this mindset. Criminals just whip up credit cards like it's nothing. They don't. It's noisy to use some grandma's credit card to buy a cert for buttsnstuff.ca when she donates to her local church five times a month. Almost all criminals are fucking dumb or even if they're smart they fuck up before they're good and land themselves in jail. Like at least 98% of them. HTTPS is a tire fire. Root certs by hostiles. Near-trivial PDAs. Termination at network edge. OS installed certs. Even when it "works" 95% of the packets are on shitty, broken ciphers with no forward secrecy. And that last 5% is built on PKI which we know quantum is breaking pretty fucking soon. Almost nobody rotates access tokens. Almost nobody layers encryption. Almost nobody safeguards certs by locking down permissions. Almost nobody pins them. Almost nobody uses HSTS. Everything is shabby and shitty and breakable. Let's Encrypt is the wrong solution. It helps irrelevant hobby websites and increases risk for medium sized companies that tried to do the right thing.
  - Latteland 8y ago
    how does let's encrypt increase the risk for anyone?
    - 3pt14159 8y ago
      Because it makes it a little easier to script forging an HTTPS cert. People here think that is easy, but it isn't. It involves real humans and real bullshit interfaces. If you get nailed with using a fake credit card its easy for any government to figure out that you also pwnd a website, but people here think in all-or-nothing terms for almost everything. I've worked on multiple projects with credit card fraud. I've helped the Canadian government with both cybercrime and machine learning. When I say 98% of criminals are dumb, I really fucking mean it. Not everyone is USG. Most governments are worse-resourced than your run-of-the-mill startup. But people don't want to hear that scriptable HTTPS has downsides and people that are in positions that come with social cache rarely listen. They end up becoming the next generation of people with blinders on. I helped with projects that threw over a dozen people in jail. We got them on two things: IP addresses and financial transactions. Let's Encrypt takes away one possible way we could have gotten them. But people on HN are so deluded about what actual crime looks like. You know how the vast majority of programmers are these dumb PHP coders that cobble together a Wordpress site? Crime is the same thing only worse. They have no fucking clue what they're doing. They bruteforce passwords and use exploits that target long-out-of-day vulns.
  - tptacek 8y ago
    Criminals who hijack websites do in fact whip up credit cards "like it's nothing". A huge chunk of abuse attempts on websites that process transactions with credit cards is performed simply to bulk-verify stolen cards. Not even to buy things with the cards; just as a sort of scammer mapreduce to see which of their zillion cards work. The idea that credit card forms are a form of defense in depth is lunacy.
    - zozbot123 8y ago
      Interesting. Could the credit card industry take advantage of this by setting up honeypots - sites that look easily exploitable to the average crook, but that would actually provide card issuers with a list of stolen cards?
- JeanMarcS 8y ago
  It’s even worse now that a lot of online services record your card so it will be easier for valid user to pay a service. If your credentials are compromised, even a paying certificate is easy to get. On a small company, the payment might be noticed. On big companies the odds are low.

Your completely right, where on Earth would criminals and scammers be able to get a credit card? /s I am having a hard time understanding how more websites using https could possibly be a worse thing.

gregmac 8y ago
Lots of people still have the mindset that http is the default and https signals a high level of trustworthiness. What we're shifting towards (and maybe already are there) is https is default, and an http-only site is an amateur setup, on the same level as hosting your site via IP (no domain name at all) or with a url like http://myisp.net/~mycompany/default.htm http://myisp.net/~mycompany/default.htm. Like it or not, browsers are treating sites like this now, and you don't see many "Secured by TrustworthyCo SSL" golden padlock badge images anymore.
3pt14159 8y ago
Yeah, yeah. So many on HN has this mindset. Criminals just whip up credit cards like it's nothing. They don't. It's noisy to use some grandma's credit card to buy a cert for buttsnstuff.ca when she donates to her local church five times a month. Almost all criminals are fucking dumb or even if they're smart they fuck up before they're good and land themselves in jail. Like at least 98% of them. HTTPS is a tire fire. Root certs by hostiles. Near-trivial PDAs. Termination at network edge. OS installed certs. Even when it "works" 95% of the packets are on shitty, broken ciphers with no forward secrecy. And that last 5% is built on PKI which we know quantum is breaking pretty fucking soon. Almost nobody rotates access tokens. Almost nobody layers encryption. Almost nobody safeguards certs by locking down permissions. Almost nobody pins them. Almost nobody uses HSTS. Everything is shabby and shitty and breakable. Let's Encrypt is the wrong solution. It helps irrelevant hobby websites and increases risk for medium sized companies that tried to do the right thing.
- Latteland 8y ago
  how does let's encrypt increase the risk for anyone?
  - 3pt14159 8y ago
    Because it makes it a little easier to script forging an HTTPS cert. People here think that is easy, but it isn't. It involves real humans and real bullshit interfaces. If you get nailed with using a fake credit card its easy for any government to figure out that you also pwnd a website, but people here think in all-or-nothing terms for almost everything. I've worked on multiple projects with credit card fraud. I've helped the Canadian government with both cybercrime and machine learning. When I say 98% of criminals are dumb, I really fucking mean it. Not everyone is USG. Most governments are worse-resourced than your run-of-the-mill startup. But people don't want to hear that scriptable HTTPS has downsides and people that are in positions that come with social cache rarely listen. They end up becoming the next generation of people with blinders on. I helped with projects that threw over a dozen people in jail. We got them on two things: IP addresses and financial transactions. Let's Encrypt takes away one possible way we could have gotten them. But people on HN are so deluded about what actual crime looks like. You know how the vast majority of programmers are these dumb PHP coders that cobble together a Wordpress site? Crime is the same thing only worse. They have no fucking clue what they're doing. They bruteforce passwords and use exploits that target long-out-of-day vulns.
- tptacek 8y ago
  Criminals who hijack websites do in fact whip up credit cards "like it's nothing". A huge chunk of abuse attempts on websites that process transactions with credit cards is performed simply to bulk-verify stolen cards. Not even to buy things with the cards; just as a sort of scammer mapreduce to see which of their zillion cards work. The idea that credit card forms are a form of defense in depth is lunacy.
  - zozbot123 8y ago
    Interesting. Could the credit card industry take advantage of this by setting up honeypots - sites that look easily exploitable to the average crook, but that would actually provide card issuers with a list of stolen cards?
JeanMarcS 8y ago
It’s even worse now that a lot of online services record your card so it will be easier for valid user to pay a service. If your credentials are compromised, even a paying certificate is easy to get. On a small company, the payment might be noticed. On big companies the odds are low.