7 ms·

On HN I've seen a lot of unencrypted sites lately. I don't personally feel comfortable browsing on them, so I avoid them. Near the end of the article here, it m

On HN I've seen a lot of unencrypted sites lately. I don't personally feel comfortable browsing on them, so I avoid them. Near the end of the article here, it mentions that this is only possible on an unencrypted website. Is there a reason why so many people are not encrypting their websites? Even browsers seem to have picked up on the insecure nature of http. Please correct me if I'm wrong here, I just find it very strange how many links I've inspected only to see a lack of TLS/SSL.

qwerty456127 6y ago
Obviously, HTTPS adds complexity many people find unnecessary + it puts you in position of depending on a 3-rd party - a certification authority. In fact you can program almost any device (including very old and simple) to be a plain old HTTP client or a server but this is not the case with modern HTTPS.
- garmaine 6y ago
  Thanks to Let's Encrypt, this is no longer the case.
  - gtirloni 6y ago
    Let's Encrypt is a 3rd-party.
    - garmaine 6y ago
      I was responding to the second paragraph. TLS is not complicated now.
      - qwerty456127 6y ago
        Being easy to use does not mean uncomplicated. Your TV set probably is easy to use and was easy to get but it still is an extremely complex machine. Using as simple things as possible (but not simpler ©) is a value in its own.
  - toohotatopic 6y ago
    Then you have a signed key but you still have to implement the crypto algorithms.
    - garmaine 6y ago
      Which is as easy as running one of a half dozen open source TLS proxies in front of your regular, unencrypted HTTP application port.
    - inetknght 6y ago
      You don't need to "implement the crypto algorithms" unless you're reinventing the wheel. You just need to get the private key and certificate (run certbot) and configure your server software (change your settings).
      - foxrob92 6y ago
        Alternatively, use caddy as a HTTPS server. It requests the certs from letsencrypt for you, for all domains that you configure it for.
        garmaine 6y ago
        You don’t know what state actor is running it though.
        inetknght 6y ago
        LetsEncrypt is good enough to protect you from ISP malfeasance and script kiddies on your public wifi. But if your threat model includes nation states then LetsEncrypt should only be one part of your defense in depth strategy.
        teddyh 6y ago
        It literally does not matter for you if Let’s Encrypt is run by a hostile entity. They never get your private key, they only give you a certificate saying your key is valid.
0xcde4c3db 6y ago
I'll admit up-front that I don't have a solid source that I can cite for this, and there's a good chance that it's outdated by now. That being said: I've heard several times that this is largely driven by the crappier flavors of "media platform" and bottom-of-the-barrel ad networks breaking in spectacular fashion due to CORS and mixed-content problems when the main site tries to switch to HTTPS.
- munchbunny 6y ago
  That was indeed a thing several years ago as ad networks were being forced to support HTTPS, but all of the major ad networks and ad servers have supported HTTPS for years at this point. I don't doubt there are some bespoke ad servers or other dark corners of ad infrastructure where HTTPS support is still lacking, but that should be rare at this point.
  - EdwardDiego 6y ago
    Yep, in the industry and if your code or servers triggered mixed content warnings, publishers dropped you fast. That said,we still have to scan every creative for https compliance because a lot of them say they are but aren't.
    - OJFord 6y ago
      > we still have to scan every creative for https compliance What's 'creative' when it's a noun? A producer of 'content'?
      - munchbunny 6y ago
        It refers to the payload that makes up the ad, e.g. the package of html, JS, CSS, and other assets that the browser actually loads.
blackrock 6y ago
What does https have to do with getting exploited? If the web server is compromised, then it’ll inject the malicious JavaScript code into the HTML, and transmit that to you. SSL is irrelevant in this regards. Unless when not using SSL, then the HTML is getting intercepted in flight, and a malicious JavaScript code is injected into the HTML. Is that more of what we are now seeing these days? The routers are compromised, and the HTML is getting compromised too. This is a legitimate question. Granted, I’m fully in support of SSL. Nobody should be seeing what you are browsing. This leaves too much digital breadcrumbs lying around.
- iotku 6y ago
  >What does https have to do with getting exploited? It significantly helps to prevent MITM [1] (Man-in-the-middle) attacks. (without scary certificate warnings anyways) >If the web server is compromised, then it’ll inject the malicious JavaScript code into the HTML, and transmit that to you. SSL is irrelevant in this regards. The web server isn't compromised in this case, presumably the network is compromised. >Unless when not using SSL, then the HTML is getting intercepted in flight, and a malicious JavaScript code is injected into the HTML. Yes. >Is that more of what we are now seeing these days? The routers are compromised, and the HTML is getting compromised too. "Stingray" devices [2] spoof mobile towers so cellphones are tricked into believing they're connecting to "Just another cell phone tower" and at that point traffic can be captured/modified. >Granted, I’m fully in support of SSL. Nobody should be seeing what you are browsing. It's more than people just knowing what you're browsing (or issues such as leaking passwords/private info), it's that if someone can MITM you, they can also transparently modify unencrypted data (including adding exploits). 1. https://en.wikipedia.org/wiki/Man-in-the-middle_attack https://en.wikipedia.org/wiki/Man-in-the-middle_attack 2. https://en.wikipedia.org/wiki/Stingray_phone_tracker https://en.wikipedia.org/wiki/Stingray_phone_tracker
  - blackrock 6y ago
    Nice reply. Thanks. I suspected MITM is now technically feasible. Although I wasn’t quite sure how widespread it was. The stingray is indeed worrying. And it’s been around for nearly 20 years now. So everyone with a cell phone, or using WiFi over a cellular hotspot, can now get caught up in a MITM exploitation attack, if they browse a non-https website. When will the network providers now issue a blanket ban on browsing over plain http?
Swizec 6y ago
I've seen this improve a lot in recent years with Let's Encrypt, so that's been a great trend. LE is still tedious as heck to set up on your own, though, so I guess people who haven't migrated to modern hosting yet are still being left behind. Most hosting-for-devs platforms these days give you HTTPS by default and don't think would even let you host a website without.
- user1980 6y ago
  Tedious to set up, tedious to maintain. January 31 of this year I got an email telling me that my LE client used the older ACMEv1 protocol, not the newer ACMEv2 protocol. They gave me 4 months notice to update my LE client to something compliant. I burnt the time and did the work. On March 3 myself and many others[0] got an email demanding that we manually re-issue our certificates because of a vulnerability discovered in the LE service. They gave us one day to comply, after that they would revoke the certificates and our users would receive security errors. I begrudgingly went through all my servers and issued the command to forcibly renew certificates. Not a huge burden for me, but likely a bigger burden for larger operations. As the feature set grows (new challenge types, wildcard support, etc.) and the service gets even more popular, it's going to be an even bigger target and the effects of a monoculture will really be felt. I'm starting to see the value in paying for certificates, and more specifically, using providers that don't provide a public certificate issuance API (or at least stick it behind a paywall.) How many times would LE have to accidentally issue gstatic.com or fbcdn.net before they get the Symantec treatment[1]? Too big to fail: It's not just for investment banks. And that should give anyone seeking a decentralized internet pause. [0]: https://www.zdnet.com/article/lets-encrypt-to-revoke-3-million-certificates-on-march-4-due-to-bug/ https://www.zdnet.com/article/lets-encrypt-to-revoke-3-milli... [1]: https://www.zdnet.com/article/mozilla-warns-it-plans-to-distrust-all-symantec-chained-certs-in-october/ https://www.zdnet.com/article/mozilla-warns-it-plans-to-dist...
  - na85 6y ago
    >Tedious to set up, tedious to maintain. It took me maybe 10 minutes to set up for my nginx setup. Debian and OpenSUSE both package letsencrypt's certbot. Tedious to set up and maintain is essentially the opposite of my experience.
shalmanese 6y ago
If your browser can be hijacked by visiting a webpage, the threat vector is not substantially different whether the website is HTTPS or not. It changes the attack path from a MITM attack to a watering hole attack but that doesn't overly raise the difficulty level. The real threat in this case was that sending the right string of data to a browser let a malicious actor execute a RCE and install malware. Either you trust the browser to be secure against such attacks or you can't trust much of anything.
- snark42 6y ago
  If I'm targeting an individual/organization a watering hole attack requires that I can own a site the target visits regularly. This seems a lot more complicated than just going to any unencrypted website via network redirection of some sort. Do most people routinely visit encrypted sites that are easily hacked to target an RCE on an individual?
  - PlasticTank 6y ago
    You don't need to compromise a site they visit regularly, there are plenty of other ways to get someone to visit a malicious page, phishing email or even a link on HackerNews for example. People will visit new sites for all kinds of reasons, you'd just need to understand your target.
    - bigiain 6y ago
      Also, I at least, have very little confidence that a state level actor couldn't subvert the news.ycombinator.com hosting provider if it wanted to seriously enough. If someone were to be "secure enough" to be running drugs/guns/children - they'd _have_ to be totally disconnected from the internet and cellular networks, and probably all their first and second level associates as well. I don't have any sympathy for those people, but sadly a journalist critical of a government has all the same problems there, and that's bad for humanity.
  - jimmydorry 6y ago
    While I'm not certain about the terminology and whether this would still be a watering hole attack, but any of the "Show HN" posts here, could trivially be hosted by an actor with malicious intentions.
londons_explore 6y ago
Because 3 lines of nodejs can make a cool web demo for HN, but making that same demo https (in a way which isn't going to require manual action every 3 months) involves many more lines of code.
- deleted 6y ago
  [deleted]
- w-ll 6y ago
  I got a 1 liner that adds a DNS record to cloudflare, with a free account and they handle all the https for my cool web demos. Or my other 1 liner cron job that runs certbot for other demos.
mistrial9 6y ago
For my simple self-publishing needs .. because I didn't make a self-signed cert for my Debian-based server, have not purchased a commercial cert, and do not want the short-term expire on LetsEncrypt. edit- I do not have javascript-driven pages, they are PDFs or simple content
- inetknght 6y ago
  You're not worried about a middleman injecting their content into yours? It's such common practice that Comcast even documented how they do it [0]. There are easily found examples of malicious content being injected into HTML -- malvertisements for example. I can only imagine what might get injected into a PDF which can run javascript [1]. PDF readers aren't exactly known for their security. Frankly, I'd much rather be able to talk to you about something downloaded from your site and get you to fix it instead of allowing a third party to infect me and point fingers at you. [0] https://tools.ietf.org/html/rfc6108 https://tools.ietf.org/html/rfc6108 [1] https://stackoverflow.com/q/9219807/1111557 https://stackoverflow.com/q/9219807/1111557
  - mistrial9 6y ago
    please lets not confuse the issue with PDF -- I know PDF internals actually, and do infact d-compile and rebuild PDF is I think there is anything fishy.. zero point zero Javascript and PDF in this setup
    - inetknght 6y ago
      I understand you know PDF internals and you can verify that you're not serving javascript in your PDF content. I'm glad you've gone to that depth of knowledge! But I'm saying that what you're serving and what the user receives can be different. When you're using plain unencrypted HTTP then anyone between you and the user can inject javascript into the PDF. The user can get a PDF file with javascript in it even though you didn't put any javascript in it.
      - _AzMoo 6y ago
ta17711771 6y ago
Because it's not included in the cheapest GoDaddy plan....
dehrmann 6y ago
> I don't personally feel comfortable browsing on them You should see the list of root certificate shipped with most major browsers.
l0b0 6y ago
As part of dealing with this I wrote a simple Firefox add-on to highlight insecure links (https://addons.mozilla.org/en-US/firefox/addon/insecure-links-highlighter/ https://addons.mozilla.org/en-US/firefox/addon/insecure-link...). Basically it gives you a big red border around any HTTP, FTP or dynamic link (that last one can be turned off as it makes sneaky places like Google light up like a holiday decoration).
joveian 6y ago
I also avoid them most of the time, although I don't think there are necessarily more of them now than previously. Sometimes the reason they are not encrypted is that they are fairly old (hopefully the server software was updated at least, although that should be much less effort than setting up https). Sometimes the sites do support https but don't redirect http to https and the http link was submitted. I did a quick manual count of yesterday's HN front page articles according to hckrnews.com and found 8 non-https links (vs. 109 total non-dead links). 2 of these have a working https version. I use the HTTPS Everywhere extension set to the new "Encrypt All Sites Eligible" option. Instead of using a list as previous HTTPS Everywhere, this tries to access all websites via https and pops up a warning if it doesn't work (most of the time; one of the six non-https supporting sites was misconfigured in a way that didn't get the popup). Since I want to know anytime I access an http site, I choose the "open insecure page for this session only" option if I want to look at an http page to make sure that it tries the https site again in the future and that I know any time I am visiting an http site. There are simpler extension that just do that, but unfortunately they are not Firefox Recommended extensions that are monitored by Mozilla. Hopefully it won't be too long before browsers do this themselves.
- user5994461 6y ago
  >>> found 8 non-https links The main root cause for missing https in HN submissions is old github pages before 2016. GitHub rolled HTTPS but didn't enable it by default for older sites. Gotta go to settings and tick https.
altfredd 6y ago
According to the article, Amnesty International assumes, that the Journalist in question was targeted by http-MITM attack. This assumptions nicely fits into popular "http is bad, https is good" narrative, but it is just a guess (and probably is far from truth). Modern browsers support multiple network code paths, several HTTP versions, dozens of TLS versions and boatload of ciphers. All of that code has RCE bugs. Besides, delivering vulnerability payload via advertising network is far more reliable — with http-only exploit chain police would have to wait and hope that Omar will someday visit an http-only site. I would expect a pricey exploit toolkit, used by governments, to be more robust than that.
catsdanxe 6y ago
You can MITM a https request and send an unencrypted 302 response to redirect the browser wherever you want it to go.

qwerty456127 6y ago

Obviously, HTTPS adds complexity many people find unnecessary + it puts you in position of depending on a 3-rd party - a certification authority. In fact you can program almost any device (including very old and simple) to be a plain old HTTP client or a server but this is not the case with modern HTTPS.

garmaine 6y ago
Thanks to Let's Encrypt, this is no longer the case.
- gtirloni 6y ago
  Let's Encrypt is a 3rd-party.
  - garmaine 6y ago
    I was responding to the second paragraph. TLS is not complicated now.
    - qwerty456127 6y ago
      Being easy to use does not mean uncomplicated. Your TV set probably is easy to use and was easy to get but it still is an extremely complex machine. Using as simple things as possible (but not simpler ©) is a value in its own.
- toohotatopic 6y ago
  Then you have a signed key but you still have to implement the crypto algorithms.
  - garmaine 6y ago
    Which is as easy as running one of a half dozen open source TLS proxies in front of your regular, unencrypted HTTP application port.
  - inetknght 6y ago
    You don't need to "implement the crypto algorithms" unless you're reinventing the wheel. You just need to get the private key and certificate (run certbot) and configure your server software (change your settings).
    - foxrob92 6y ago
      Alternatively, use caddy as a HTTPS server. It requests the certs from letsencrypt for you, for all domains that you configure it for.
      - garmaine 6y ago
        You don’t know what state actor is running it though.
        inetknght 6y ago
        LetsEncrypt is good enough to protect you from ISP malfeasance and script kiddies on your public wifi. But if your threat model includes nation states then LetsEncrypt should only be one part of your defense in depth strategy.
        teddyh 6y ago
        It literally does not matter for you if Let’s Encrypt is run by a hostile entity. They never get your private key, they only give you a certificate saying your key is valid.

0xcde4c3db 6y ago

I'll admit up-front that I don't have a solid source that I can cite for this, and there's a good chance that it's outdated by now. That being said: I've heard several times that this is largely driven by the crappier flavors of "media platform" and bottom-of-the-barrel ad networks breaking in spectacular fashion due to CORS and mixed-content problems when the main site tries to switch to HTTPS.

munchbunny 6y ago
That was indeed a thing several years ago as ad networks were being forced to support HTTPS, but all of the major ad networks and ad servers have supported HTTPS for years at this point. I don't doubt there are some bespoke ad servers or other dark corners of ad infrastructure where HTTPS support is still lacking, but that should be rare at this point.
- EdwardDiego 6y ago
  Yep, in the industry and if your code or servers triggered mixed content warnings, publishers dropped you fast. That said,we still have to scan every creative for https compliance because a lot of them say they are but aren't.
  - OJFord 6y ago
    > we still have to scan every creative for https compliance What's 'creative' when it's a noun? A producer of 'content'?
    - munchbunny 6y ago
      It refers to the payload that makes up the ad, e.g. the package of html, JS, CSS, and other assets that the browser actually loads.

blackrock 6y ago

What does https have to do with getting exploited? If the web server is compromised, then it’ll inject the malicious JavaScript code into the HTML, and transmit that to you. SSL is irrelevant in this regards. Unless when not using SSL, then the HTML is getting intercepted in flight, and a malicious JavaScript code is injected into the HTML. Is that more of what we are now seeing these days? The routers are compromised, and the HTML is getting compromised too. This is a legitimate question. Granted, I’m fully in support of SSL. Nobody should be seeing what you are browsing. This leaves too much digital breadcrumbs lying around.

iotku 6y ago
>What does https have to do with getting exploited? It significantly helps to prevent MITM [1] (Man-in-the-middle) attacks. (without scary certificate warnings anyways) >If the web server is compromised, then it’ll inject the malicious JavaScript code into the HTML, and transmit that to you. SSL is irrelevant in this regards. The web server isn't compromised in this case, presumably the network is compromised. >Unless when not using SSL, then the HTML is getting intercepted in flight, and a malicious JavaScript code is injected into the HTML. Yes. >Is that more of what we are now seeing these days? The routers are compromised, and the HTML is getting compromised too. "Stingray" devices [2] spoof mobile towers so cellphones are tricked into believing they're connecting to "Just another cell phone tower" and at that point traffic can be captured/modified. >Granted, I’m fully in support of SSL. Nobody should be seeing what you are browsing. It's more than people just knowing what you're browsing (or issues such as leaking passwords/private info), it's that if someone can MITM you, they can also transparently modify unencrypted data (including adding exploits). 1. https://en.wikipedia.org/wiki/Man-in-the-middle_attack https://en.wikipedia.org/wiki/Man-in-the-middle_attack 2. https://en.wikipedia.org/wiki/Stingray_phone_tracker https://en.wikipedia.org/wiki/Stingray_phone_tracker
- blackrock 6y ago
  Nice reply. Thanks. I suspected MITM is now technically feasible. Although I wasn’t quite sure how widespread it was. The stingray is indeed worrying. And it’s been around for nearly 20 years now. So everyone with a cell phone, or using WiFi over a cellular hotspot, can now get caught up in a MITM exploitation attack, if they browse a non-https website. When will the network providers now issue a blanket ban on browsing over plain http?

Swizec 6y ago

I've seen this improve a lot in recent years with Let's Encrypt, so that's been a great trend. LE is still tedious as heck to set up on your own, though, so I guess people who haven't migrated to modern hosting yet are still being left behind. Most hosting-for-devs platforms these days give you HTTPS by default and don't think would even let you host a website without.

user1980 6y ago
Tedious to set up, tedious to maintain. January 31 of this year I got an email telling me that my LE client used the older ACMEv1 protocol, not the newer ACMEv2 protocol. They gave me 4 months notice to update my LE client to something compliant. I burnt the time and did the work. On March 3 myself and many others[0] got an email demanding that we manually re-issue our certificates because of a vulnerability discovered in the LE service. They gave us one day to comply, after that they would revoke the certificates and our users would receive security errors. I begrudgingly went through all my servers and issued the command to forcibly renew certificates. Not a huge burden for me, but likely a bigger burden for larger operations. As the feature set grows (new challenge types, wildcard support, etc.) and the service gets even more popular, it's going to be an even bigger target and the effects of a monoculture will really be felt. I'm starting to see the value in paying for certificates, and more specifically, using providers that don't provide a public certificate issuance API (or at least stick it behind a paywall.) How many times would LE have to accidentally issue gstatic.com or fbcdn.net before they get the Symantec treatment[1]? Too big to fail: It's not just for investment banks. And that should give anyone seeking a decentralized internet pause. [0]: https://www.zdnet.com/article/lets-encrypt-to-revoke-3-million-certificates-on-march-4-due-to-bug/ https://www.zdnet.com/article/lets-encrypt-to-revoke-3-milli... [1]: https://www.zdnet.com/article/mozilla-warns-it-plans-to-distrust-all-symantec-chained-certs-in-october/ https://www.zdnet.com/article/mozilla-warns-it-plans-to-dist...
- na85 6y ago
  >Tedious to set up, tedious to maintain. It took me maybe 10 minutes to set up for my nginx setup. Debian and OpenSUSE both package letsencrypt's certbot. Tedious to set up and maintain is essentially the opposite of my experience.

shalmanese 6y ago

If your browser can be hijacked by visiting a webpage, the threat vector is not substantially different whether the website is HTTPS or not. It changes the attack path from a MITM attack to a watering hole attack but that doesn't overly raise the difficulty level. The real threat in this case was that sending the right string of data to a browser let a malicious actor execute a RCE and install malware. Either you trust the browser to be secure against such attacks or you can't trust much of anything.

snark42 6y ago
If I'm targeting an individual/organization a watering hole attack requires that I can own a site the target visits regularly. This seems a lot more complicated than just going to any unencrypted website via network redirection of some sort. Do most people routinely visit encrypted sites that are easily hacked to target an RCE on an individual?
- PlasticTank 6y ago
  You don't need to compromise a site they visit regularly, there are plenty of other ways to get someone to visit a malicious page, phishing email or even a link on HackerNews for example. People will visit new sites for all kinds of reasons, you'd just need to understand your target.
  - bigiain 6y ago
    Also, I at least, have very little confidence that a state level actor couldn't subvert the news.ycombinator.com hosting provider if it wanted to seriously enough. If someone were to be "secure enough" to be running drugs/guns/children - they'd _have_ to be totally disconnected from the internet and cellular networks, and probably all their first and second level associates as well. I don't have any sympathy for those people, but sadly a journalist critical of a government has all the same problems there, and that's bad for humanity.
- jimmydorry 6y ago
  While I'm not certain about the terminology and whether this would still be a watering hole attack, but any of the "Show HN" posts here, could trivially be hosted by an actor with malicious intentions.

londons_explore 6y ago

Because 3 lines of nodejs can make a cool web demo for HN, but making that same demo https (in a way which isn't going to require manual action every 3 months) involves many more lines of code.

deleted 6y ago
[deleted]
w-ll 6y ago
I got a 1 liner that adds a DNS record to cloudflare, with a free account and they handle all the https for my cool web demos. Or my other 1 liner cron job that runs certbot for other demos.

mistrial9 6y ago

For my simple self-publishing needs .. because I didn't make a self-signed cert for my Debian-based server, have not purchased a commercial cert, and do not want the short-term expire on LetsEncrypt. edit- I do not have javascript-driven pages, they are PDFs or simple content

inetknght 6y ago
You're not worried about a middleman injecting their content into yours? It's such common practice that Comcast even documented how they do it [0]. There are easily found examples of malicious content being injected into HTML -- malvertisements for example. I can only imagine what might get injected into a PDF which can run javascript [1]. PDF readers aren't exactly known for their security. Frankly, I'd much rather be able to talk to you about something downloaded from your site and get you to fix it instead of allowing a third party to infect me and point fingers at you. [0] https://tools.ietf.org/html/rfc6108 https://tools.ietf.org/html/rfc6108 [1] https://stackoverflow.com/q/9219807/1111557 https://stackoverflow.com/q/9219807/1111557
- mistrial9 6y ago
  please lets not confuse the issue with PDF -- I know PDF internals actually, and do infact d-compile and rebuild PDF is I think there is anything fishy.. zero point zero Javascript and PDF in this setup
  - inetknght 6y ago
    I understand you know PDF internals and you can verify that you're not serving javascript in your PDF content. I'm glad you've gone to that depth of knowledge! But I'm saying that what you're serving and what the user receives can be different. When you're using plain unencrypted HTTP then anyone between you and the user can inject javascript into the PDF. The user can get a PDF file with javascript in it even though you didn't put any javascript in it.
    - _AzMoo 6y ago

ta17711771 6y ago

Because it's not included in the cheapest GoDaddy plan....

dehrmann 6y ago

> I don't personally feel comfortable browsing on them You should see the list of root certificate shipped with most major browsers.

l0b0 6y ago

As part of dealing with this I wrote a simple Firefox add-on to highlight insecure links (https://addons.mozilla.org/en-US/firefox/addon/insecure-links-highlighter/ https://addons.mozilla.org/en-US/firefox/addon/insecure-link...). Basically it gives you a big red border around any HTTP, FTP or dynamic link (that last one can be turned off as it makes sneaky places like Google light up like a holiday decoration).

joveian 6y ago

I also avoid them most of the time, although I don't think there are necessarily more of them now than previously. Sometimes the reason they are not encrypted is that they are fairly old (hopefully the server software was updated at least, although that should be much less effort than setting up https). Sometimes the sites do support https but don't redirect http to https and the http link was submitted. I did a quick manual count of yesterday's HN front page articles according to hckrnews.com and found 8 non-https links (vs. 109 total non-dead links). 2 of these have a working https version. I use the HTTPS Everywhere extension set to the new "Encrypt All Sites Eligible" option. Instead of using a list as previous HTTPS Everywhere, this tries to access all websites via https and pops up a warning if it doesn't work (most of the time; one of the six non-https supporting sites was misconfigured in a way that didn't get the popup). Since I want to know anytime I access an http site, I choose the "open insecure page for this session only" option if I want to look at an http page to make sure that it tries the https site again in the future and that I know any time I am visiting an http site. There are simpler extension that just do that, but unfortunately they are not Firefox Recommended extensions that are monitored by Mozilla. Hopefully it won't be too long before browsers do this themselves.

user5994461 6y ago
>>> found 8 non-https links The main root cause for missing https in HN submissions is old github pages before 2016. GitHub rolled HTTPS but didn't enable it by default for older sites. Gotta go to settings and tick https.

altfredd 6y ago

According to the article, Amnesty International assumes, that the Journalist in question was targeted by http-MITM attack. This assumptions nicely fits into popular "http is bad, https is good" narrative, but it is just a guess (and probably is far from truth). Modern browsers support multiple network code paths, several HTTP versions, dozens of TLS versions and boatload of ciphers. All of that code has RCE bugs. Besides, delivering vulnerability payload via advertising network is far more reliable — with http-only exploit chain police would have to wait and hope that Omar will someday visit an http-only site. I would expect a pricey exploit toolkit, used by governments, to be more robust than that.

catsdanxe 6y ago

You can MITM a https request and send an unencrypted 302 response to redirect the browser wherever you want it to go.