3 ms·

The biggest problem with forcing everything HTTPS is a false sense of security & trust that this gives to none-techie users. Security of the data transfer laye

by edf13 7y ago

The biggest problem with forcing everything HTTPS is a false sense of security & trust that this gives to none-techie users. Security of the data transfer layer does not mean can or should trust the website you are visiting. Just because a website has a padlock does not mean it is trust worthy and you can hand over your CC details. https://www.amazon.somethiing.other.co/greatDiscount https://www.amazon.somethiing.other.co/greatDiscount may look great to some!

minitech 7y ago
This is exactly the opposite of a forcing HTTPS problem. When HTTPS isn’t everywhere, HTTPS gives a false sense of security. When it is, browsers can stop emphasizing it. We’re already well down that path, with padlocks no longer being green/being hidden entirely, EV certificates losing their confusion vector, insecure pages being assigned the icon that sticks out…
LeonM 7y ago
I think that was the main reason why browser vendors moved away from the green padlock symbol.
seqastian 7y ago
> The biggest problem with forcing everything HTTPS No it isn't. Https not being 100% bulletproof is unrelated to using it everywhere. And it's lightyears away from its biggest problem.
em-bee 7y ago
true but the only way to get there is to force http into oblivion. right now people think: http: insecure and https: secure probably only when http ceases to exist can we start differentiating between trustworthy and untrustworty. how we actually do that is something we still need to figure out. for now we have a check against sites that are known to distribute malware. maybe we need to somehow track which sites are known to be trustworthy. different factors can go into that. their privacy statement, past incidents and their response. etc...
simias 7y ago
If we migrate to HTTPS everywhere we can get rid of HTTP for general use and switch to a different UI, where HTTPS websites don't have any special icon but HTTP ones get a warning icon. It's already effectively how password form submissions work in many browsers.
- oneeyedpigeon 7y ago
  We could already do that — just do away with the padlock icon now. In my browser, anyway, http:// http:// gives a big "non secure" warning.
  - simias 7y ago
    The problem is that, for better or worse, generations of internet users have been taught to look for the padlock before sharing any sensitive info (especially banking credentials and the like). Suddenly removing this prompt is probably going to confuse and worry many people.
- greggman2 7y ago
  You can't have HTTPS everywhere until we can get HTTPS for IoT devices. My router doesn't serve it's configuration screen via HTTPS. How could it? I have to connect to it to configure it before it's on the internet. Same with my IoT cameras and all the various local apps I run that can start a web server. Heck, my iPhone has tons of apps that start webservers for uploading data since iPhone's file sync sucks so bad. We need a solution to HTTPS for devices inside home networks.
  - simias 7y ago
    I agree that having an elegant and secure solution to enable HTTPS on non-internet-facing equipment would be nice. I work mainly on embedded devices and all my admin interfaces are over HTTP because there's simply no way to ship a certificate that would work anywhere. It would be nice if you could easily deploy self-signed certificates that would only work for local addresses and only for specific devices, although of course doing that securely and with good UI would be tricky. In the meantime having big warnings when connecting to these ad-hoc web interfaces makes sense I think, since they can effectively easily be spoofed and MitM'd (LANs are not always secure in the first place so it makes sense to warn the user not to reuse a sensitive password for instance). It's annoying for us embedded devs but I think it's for the greater good.

by edf13 7y ago

minitech 7y ago

This is exactly the opposite of a forcing HTTPS problem. When HTTPS isn’t everywhere, HTTPS gives a false sense of security. When it is, browsers can stop emphasizing it. We’re already well down that path, with padlocks no longer being green/being hidden entirely, EV certificates losing their confusion vector, insecure pages being assigned the icon that sticks out…

LeonM 7y ago

I think that was the main reason why browser vendors moved away from the green padlock symbol.

seqastian 7y ago

> The biggest problem with forcing everything HTTPS No it isn't. Https not being 100% bulletproof is unrelated to using it everywhere. And it's lightyears away from its biggest problem.

em-bee 7y ago

true but the only way to get there is to force http into oblivion. right now people think: http: insecure and https: secure probably only when http ceases to exist can we start differentiating between trustworthy and untrustworty. how we actually do that is something we still need to figure out. for now we have a check against sites that are known to distribute malware. maybe we need to somehow track which sites are known to be trustworthy. different factors can go into that. their privacy statement, past incidents and their response. etc...

simias 7y ago

If we migrate to HTTPS everywhere we can get rid of HTTP for general use and switch to a different UI, where HTTPS websites don't have any special icon but HTTP ones get a warning icon. It's already effectively how password form submissions work in many browsers.

oneeyedpigeon 7y ago
We could already do that — just do away with the padlock icon now. In my browser, anyway, http:// http:// gives a big "non secure" warning.
- simias 7y ago
  The problem is that, for better or worse, generations of internet users have been taught to look for the padlock before sharing any sensitive info (especially banking credentials and the like). Suddenly removing this prompt is probably going to confuse and worry many people.
greggman2 7y ago
You can't have HTTPS everywhere until we can get HTTPS for IoT devices. My router doesn't serve it's configuration screen via HTTPS. How could it? I have to connect to it to configure it before it's on the internet. Same with my IoT cameras and all the various local apps I run that can start a web server. Heck, my iPhone has tons of apps that start webservers for uploading data since iPhone's file sync sucks so bad. We need a solution to HTTPS for devices inside home networks.
- simias 7y ago
  I agree that having an elegant and secure solution to enable HTTPS on non-internet-facing equipment would be nice. I work mainly on embedded devices and all my admin interfaces are over HTTP because there's simply no way to ship a certificate that would work anywhere. It would be nice if you could easily deploy self-signed certificates that would only work for local addresses and only for specific devices, although of course doing that securely and with good UI would be tricky. In the meantime having big warnings when connecting to these ad-hoc web interfaces makes sense I think, since they can effectively easily be spoofed and MitM'd (LANs are not always secure in the first place so it makes sense to warn the user not to reuse a sensitive password for instance). It's annoying for us embedded devs but I think it's for the greater good.