5 ms·

We really need to get rid of the crazy error message that scares users into thinking that encrypting traffic with a self signed certificate is somehow less secu

We really need to get rid of the crazy error message that scares users into thinking that encrypting traffic with a self signed certificate is somehow less secure than not encrypting traffic at all.

jdsully 8y ago
Being solved the in the other direction, soon all unencrypted traffic will be marked as dangerous. FWIW the trend has been ongoing for a long time. I remember 10 years ago being frustrated I couldn't scp with the NULL cipher on my own local LAN unless I built from source.
- RandomInteger4 8y ago
  What benefit do you gain from making your life more complicated just to use scp with a null cipher?
Data_Junkie 8y ago
Yeah, that's the real problem. The idea that encryption is only safe for users if the site is registered with " authority(ies) " is one of the biggest delusions going right now. Politics of fear.
ravenstine 8y ago
HTTPS is so easy to set up, whether one uses a certificate or not, that I think that HTTP should be treated as dangerous by the browser and highlighted in red. The default browser behavior should be that of HTTPS Everywhere in that it will show a warning page before letting you override it and continue to the HTTP version. The problem is that browsers might not ever implement anything like that, even providing an unobtrusive danger warning, because so many everyday users would be scared by it or assume their browser is "broken" because their last browser didn't do that on most websites. Regardless, that really should be the default behavior. There's simply no excuse for not providing an encrypted connection. It comes with virtually every web server out of the box.
- IshKebab 8y ago
  HTTPS is not easy to set up unless you happen to be using a system that does it automatically via LetsEncrypt, which is fairly rare. And I don't know how you think you can use HTTPS without a certificate.
  - ravenstine 8y ago
    > HTTPS is not easy to set up unless you happen to be using a system that does it automatically via LetsEncrypt, which is fairly rare. And I don't know how you think you can use HTTPS without a certificate. What I meant is that you can use a self-signed certificate, which is takes seconds go create. Some server software will even do it for you if I remember correctly. If this is too had for someone to implement, then they really have no business building web apps. In a world where unencrypted connections are scary and an encrypted but self-signed connection is treated like HTTP connections currently are(not scary), it only makes sense for people to support HTTPS. There's nothing inherently hard about implementing an HTTPS service beyond one extra initial step. Beyond that, there's LetsEncrypt, and services like AWS will take care of creating signed certificates for you; I imagine they aren't the only infrastructure host that does this.
  - RandomInteger4 8y ago
    Let's encrypt isn't difficult to set up at all. Like, at all at all. Not even a smidge. A fifth grader can do it after reading a simple tutorial.
- ehonda 8y ago
  > There's simply no excuse for not providing an encrypted connection. Its use in every situation (ie, browsing a website dedicated to reviews on salt shakers), might not be necessary and could cause an affect similar to the overuse of antibacterial soap. :p It will also prevent older computers from accessing the web as ssl standards evolve, which is kind of a shame.
  - ravenstine 8y ago
    It might not be "necessary" for a website dedicated to salt shakers, but if I can provide my users privacy when reading my site(unencrypted DNS notwithstanding), why wouldn't I? It should be a common courtesy. While I'm browsing the web, I should expect that nobody but the host can tell what it is that I'm doing. > It will also prevent older computers from accessing the web as ssl standards evolve, which is kind of a shame. At what point should an older computer no longer work with the current web? Eventually there's going to be a breaking change. A computer old enough that its browser can't be updated is probably vulnerable to all sorts of browser-based attacks.

We really need to get rid of the crazy error message that scares users into thinking that encrypting traffic with a self signed certificate is somehow less secure than not encrypting traffic at all.

jdsully 8y ago

Being solved the in the other direction, soon all unencrypted traffic will be marked as dangerous. FWIW the trend has been ongoing for a long time. I remember 10 years ago being frustrated I couldn't scp with the NULL cipher on my own local LAN unless I built from source.

RandomInteger4 8y ago
What benefit do you gain from making your life more complicated just to use scp with a null cipher?

Data_Junkie 8y ago

Yeah, that's the real problem. The idea that encryption is only safe for users if the site is registered with " authority(ies) " is one of the biggest delusions going right now. Politics of fear.

ravenstine 8y ago

HTTPS is so easy to set up, whether one uses a certificate or not, that I think that HTTP should be treated as dangerous by the browser and highlighted in red. The default browser behavior should be that of HTTPS Everywhere in that it will show a warning page before letting you override it and continue to the HTTP version. The problem is that browsers might not ever implement anything like that, even providing an unobtrusive danger warning, because so many everyday users would be scared by it or assume their browser is "broken" because their last browser didn't do that on most websites. Regardless, that really should be the default behavior. There's simply no excuse for not providing an encrypted connection. It comes with virtually every web server out of the box.

IshKebab 8y ago
HTTPS is not easy to set up unless you happen to be using a system that does it automatically via LetsEncrypt, which is fairly rare. And I don't know how you think you can use HTTPS without a certificate.
- ravenstine 8y ago
  > HTTPS is not easy to set up unless you happen to be using a system that does it automatically via LetsEncrypt, which is fairly rare. And I don't know how you think you can use HTTPS without a certificate. What I meant is that you can use a self-signed certificate, which is takes seconds go create. Some server software will even do it for you if I remember correctly. If this is too had for someone to implement, then they really have no business building web apps. In a world where unencrypted connections are scary and an encrypted but self-signed connection is treated like HTTP connections currently are(not scary), it only makes sense for people to support HTTPS. There's nothing inherently hard about implementing an HTTPS service beyond one extra initial step. Beyond that, there's LetsEncrypt, and services like AWS will take care of creating signed certificates for you; I imagine they aren't the only infrastructure host that does this.
- RandomInteger4 8y ago
  Let's encrypt isn't difficult to set up at all. Like, at all at all. Not even a smidge. A fifth grader can do it after reading a simple tutorial.
ehonda 8y ago
> There's simply no excuse for not providing an encrypted connection. Its use in every situation (ie, browsing a website dedicated to reviews on salt shakers), might not be necessary and could cause an affect similar to the overuse of antibacterial soap. :p It will also prevent older computers from accessing the web as ssl standards evolve, which is kind of a shame.
- ravenstine 8y ago
  It might not be "necessary" for a website dedicated to salt shakers, but if I can provide my users privacy when reading my site(unencrypted DNS notwithstanding), why wouldn't I? It should be a common courtesy. While I'm browsing the web, I should expect that nobody but the host can tell what it is that I'm doing. > It will also prevent older computers from accessing the web as ssl standards evolve, which is kind of a shame. At what point should an older computer no longer work with the current web? Eventually there's going to be a breaking change. A computer old enough that its browser can't be updated is probably vulnerable to all sorts of browser-based attacks.