9 ms·
United States wants HTTPS for all government sites, all the time
- kevingadd 6y agoGonna be unfortunate when they find out they've made HTTPS illegal indirectly by banning encryption! It really is amazing to see how often one part of the government will actively sabotage the goals of other agencies.
- wesley_snipes 6y agoRemember it's always one standard for the spooks and one standard for the unwashed plebs. They keep you safe so you should be grateful.
- LinuxBender 6y agoI don't believe they are making encryption illegal. Rather, they would likely require any org doing TLS for them to provide lawful intercept, logging, audit and compliance. If a government org is managing their own network stack, then requiring TLS would be a non issue as they can provide their audit orgs with all the data they want, as they likely do today. From all the bills I have read, there is nothing that makes encryption illegal. They want the ability to access data from the servers after it has been decrypted. This includes a way to intercept what users perceive to be end-to-end encryption. The only problem I have run into with various government orgs is the lack of knowledge around implementing intermediate certificates. They will often try to talk people into installing their certs rather than installing intermediate certs correctly. I always point them to testssl.sh [1] [1] - https://github.com/drwetter/testssl.sh https://github.com/drwetter/testssl.sh
- cryptoz 6y agoI am having trouble parsing your comment. What do you mean by, > I don't believe they are making encryption illegal....They want the ability to access data from the servers after it has been decrypted. This includes a way to intercept what users perceive to be end-to-end encryption. This is contradictory, no? The data is not encrypted between 2 users if a 3rd user can read it. It sounds like every bill you read makes encryption illegal, by your own explanation of the bill? I just don't understand what you mean here. Maybe it's my personal understanding of 'encryption'? If Alice encrypts a message to Bob, and also gives the keys to Eve, but doesn't tell Bob that Eve has the keys, then I do not personally consider that message encrypted at all. Do you? What about the bills? A message encrypted with a key held by a potential attacker is not an encrypted message any more.
- LinuxBender 6y agoPerhaps this is a terminology issue. Encryption being illegal implies to me that if someone uses encryption, they are violating a law and will be penalized. Providing lawful intercept (backdoors) does not preclude the use of encryption; but rather, renders it non existent for those with the lawful intercept access. Where this gets really sketchy is if companies give users the perception that they have end-to-end encryption, but also have a way to intercept that traffic. So I think we are in effect saying the same thing, but I am just saying that encryption is not illegal, just rendered non existent for specific parties. This is actually already in place today in many of the big centralized service providers. I believe these proposed laws are just a way to officiate this so that companies are protected and less likely to resist requests for information for fear of legal repercussion.
- wizzwizz4 6y ago> but rather, renders it non existent for those with the lawful intercept access And for plenty of people who don't have the lawful intercept access. This downgrades encryption from "encrypts stuff" to "obfuscates stuff"; while technically incorrect, it's probably better to describe this as "no longer encryption" because it's clearer to non-techies.
- LinuxBender 6y agoNo, encryption still encrypts stuff. There is no obfuscation being suggested in these bills. Rather, some groups will have the ability to see data without encryption, as they do today, but with easier access and less red tape and less having to do inside deals and people looking the other way or depending on NSL's. Please don't get me wrong, I am not in support of these bills. I think it is risky to incorrectly describe what is happening, especially for non technical people. I believe the right way to describe this to non technical people would be: "Today, some people can see your traffic even if it is encrypted. If one of these bills (there are a few versions) are approved, then more groups will be able to see your data, easier and quicker." If you want to get people more interested in speaking up, then the best lessons learned would be from the interview between John Oliver and Edward Snowden. John interviewed many people on the street about the NSA having access to all your phone data. Nobody cared until he clarified and said, "So you would be ok with government employees looking at your significant others nude pics / sexting pics". At that point, most of the people interviewed said they would be furious.
- rezonant 6y agoWhat? No, GP is talking about EARN IT et al which would mandate backdoors in encryption tech
- klyrs 6y agoIf the government holds the private keys, don't they have that backdoor access to their own https traffic?
- rezonant 6y agoWho watches the watchers?
- president 6y agoWhere again does EARN IT [1] mention anything about mandating backdoors in encryption tech? [1] https://www.congress.gov/bill/116th-congress/senate-bill/3398/text https://www.congress.gov/bill/116th-congress/senate-bill/339...
- president 6y agoAfter observing the mountains of opposition to EARN IT on large tech sites like Reddit and HN, I am starting to believe the "banning encryption" meme was started by tech companies to cripple the bill even though the word "encryption" isn't mentioned anywhere in the bill text. Guessing they are not liking the fact that the bill would force sites to be liable for illegal user-submitted content on their websites: "(3) MATTERS ADDRESSED.—The matters addressed by the recommended best practices developed and submitted by the Commission under paragraph (1) shall include— (A) preventing, identifying, disrupting, and reporting child sexual exploitation; (B) coordinating with non-profit organizations and other providers of interactive computer services to preserve, remove from view, and report child sexual exploitation; (C) retaining child sexual exploitation content and related user identification and location data; (D) receiving and triaging reports of child sexual exploitation by users of interactive computer services, including self-reporting; (E) implementing a standard rating and categorization system to identify the type and severity of child sexual abuse material; (F) training and supporting content moderators who review child sexual exploitation content for the purposes of preventing and disrupting online child sexual exploitation; (G) preparing and issuing transparency reports, including disclosures in terms of service, relating to identifying, categorizing, and reporting child sexual exploitation and efforts to prevent and disrupt online child sexual exploitation; (H) coordinating with voluntary initiatives offered among and to providers of interactive computer services relating to identifying, categorizing, and reporting child sexual exploitation; (I) employing age rating and age gating systems to reduce child sexual exploitation; (J) offering parental control products that enable customers to limit the types of websites, social media platforms, and internet content that are accessible to children; and (K) contractual and operational practices to ensure third parties, contractors, and affiliates comply with the best practices."
- thephyber 6y agoFrom the EFF (a civil liberties organization, not a tech company) coverage: > We’ve explained how the EARN IT Act could be used to drastically undermine encryption. Although the bill doesn’t use the word “encryption” in its text, it gives government officials like Attorney General William Barr the power to compel online service providers to break encryption or be exposed to potentially crushing legal liability. > The bill also violates the Constitution’s protections for free speech and privacy. As Congress considers the EARN IT Act—which would require online platforms to comply with to-be-determined “best practices” in order to preserve certain protections from criminal and civil liability for user-generated content under Section 230 (47 U.S.C. § 230)—it’s important to highlight the bill’s First and Fourth Amendment problems. [1] https://www.eff.org/deeplinks/2020/03/earn-it-act-violates-constitution https://www.eff.org/deeplinks/2020/03/earn-it-act-violates-c...
- clairity 6y agoeven better would be to kick google (and microsoft to a lesser extent) out of any and all government services, including gmail, analytics, captcha, android, forms, js, fonts, apis, storage, etc. it maddens me to have to turn over sensitive data to google to get government services nowadays. they've crept into every dark corner and crevice of government. the governments we have are already wanting to surveil us plenty, we don't need a shadow entity doing it too.
- cheschire 6y agoSo you're advocating for the government to build these tools in-house then?
- clairity 6y agoin some cases, yes. in others, for them to procure from product companies rather than data companies.
- deleted 6y ago[deleted]
- austincheney 6y agoGovernment and the military should absolutely be encouraged to write their own in house tools. That would dramatically improve quality of service and simultaneously reduced government expenses.
- 0xffff2 6y ago> That would dramatically improve quality of service... I find this doubtful. > ... and simultaneously reduced government expenses. I find this almost tautologically impossible. By and large the government (my corner of it anyway) doesn't pay extra for licenses to commercial software. The idea that we could somehow find and hire enough developers to rewrite the entire Microsoft ecosystem, and somehow do it for less than it costs us to pay for Office 365 every year, requires some serious justification.
- robador 6y agoThis reads like an article of 5 years ago... Did time stand still?
- cryptoz 6y agoIn the US Government, for almost all of the last 5 years, there has been a concerted effort to move backwards, not to stand still or move forwards.
- bigbob2 6y agoJust 5 years?
- pphysch 6y agoOkay, 50 years.
- pkage 6y agoFrom my experience as a US government-adjacent worker, there are a few agencies that are really working hard to drag the govt into the present. The General Service Administration's digital efforts (login.gov, Digital Strategy, etc.) are fighting inertia to try to modernize the gov't. Additionally, the public research being done at NASA/NIH/other labs requires a lot of infrastructure—and that's spilling over into other labs and agencies. However, it's all fighting the insane bureaucratic system that requires mountains of paperwork to do anything, as well as requirements to contract out jobs to expensive and shitty contractors.
- partiallypro 6y agoThis has nothing to do with any administration, governments move slow. They have a lot of internal special interests (and I'm not talking about contractors) that fight to keep the status quo, largely because change can lead to people's jobs becoming irrelevant, etc. Then there are heaps of channels and regulations you have to go through to get anything done, even if you are an independent agency. Anyone that has worked in a large corporation or government knows how it works. The bigger is it is, the harder it is to implement change...even if it is the most basic change imaginable. This is one reason I currently would rather work for smaller companies where my voice can be heard and changes are more agile. Granted if a big tech giant like Microsoft offered me a job, I wouldn't decline...but some other corporations/government, especially old media companies, are like trying to roll a boulder up a muddy hill in terms of getting anything done; and I'd want nothing to do with it.
- tcberry 6y agoI would love it if DoD/VA sites would stop using wonky certificate settings all the time.
- deleted 6y ago[deleted]
- boris-ning-usds 6y agoHi, this is Boris Ning from United States Digital Service. Can you go into specifics of the "wonky certificate settings"? I can probably help you out with that or at least bring it to the attention of the team here at VA.
- Donald 6y agoThey're likely referring to different parts of the federal government maintaining separate PKI. For example, the DoD has separate certificate structure (https://public.cyber.mil/pki-pke/ https://public.cyber.mil/pki-pke/) and these certificates aren't commonly pre-installed on platforms used by US citizens.
- boris-ning-usds 6y agoAh, understood. Most federal agencies have their own internal PKI systems, and DoD is probably more unique than others because the infrastructure is bigger, older, and has different regulations governing them. Most civilian agencies such as VA aside from DoD - should utilize public PKI / public CA for their certificates.
- tcberry 6y agoI don't know if calling out the VA specifically is particularly fair on my part – it's possible my issue has been solely when attempting to access DoD sites secured by DoD certificates. Does any other government org in-house their certificates for internal sites in this way that is completely divorced from other root authorities?
- Fiveplus 6y agoRelevant story from 2 days ago. Direct Link: https://home.dotgov.gov/management/preloading/dotgovhttps/ https://home.dotgov.gov/management/preloading/dotgovhttps/ Posted here: https://news.ycombinator.com/item?id=23609538 https://news.ycombinator.com/item?id=23609538
- jlgaddis 6y ago... with zero discussion.
- pbhjpbhj 6y agoHow could they not have https, is that by decision, or by incompetence, or...?
- HenryKissinger 6y agoEvery change has to go through months, or years, of review, and be approved by 50 different people. I take it you've never worked for the government, have you?
- hirundo 6y agoOnly until around April 16th. https://en.wikipedia.org/wiki/Tax_Freedom_Day https://en.wikipedia.org/wiki/Tax_Freedom_Day
- pbhjpbhj 6y agoSo the site devs fixed it 5 years ago and we've been waiting for management to sign off "should we implement basic site security"? Heads should roll, really.
- kache_ 6y agoNot everything needs https. You can read more about this here: http://n-gate.com/software/2017/ http://n-gate.com/software/2017/ (Discourse on https)
- 6y ago
- aequitas 6y agoShameless plug: our team developed an open-source tool that helps organisations visualize security issues (like missing https) on a map so it is easy relatable for citizens (and government employees) if for example their municipality is doing a bad job and helps those citizens (and goverment organizations) improve their security. It's free and easy to setup for your own country if you're interested: https://websecuritymap.org/ https://websecuritymap.org/ Example of the site running for the Netherlands: https://basisbeveiliging.nl/ https://basisbeveiliging.nl/
- mkranjec 6y agoThank you kind stranger. Looks promising.
- rapnie 6y agoThanks, looks interesting. PS. The .org site does not look well on FF/Android (texts clipped, etc.)
- ThePowerOfFuet 6y agoAlso renders terribly in Safari on iOS 13.5.1.
- aequitas 6y agoThanks for the feedback, it's noted: https://gitlab.com/internet-cleanup-foundation/web-security-map/-/issues/254 https://gitlab.com/internet-cleanup-foundation/web-security-...
- raybb 6y agoThis may be a silly question but do you know of any high profile incidents where not having https has been an issue? I understand the risks but am curious if there have been some cases that are pushing https forward after they got publicity.
- gentleman11 6y agoWhich is it - HTTPS for for everything, or ban it? Or is it that they think only they should be able to use it? https://news.ycombinator.com/item?id=23636487 https://news.ycombinator.com/item?id=23636487
- austincheney 6y agoYou are falsely assuming government agencies have a shared set of priorities in common agreement. https://en.m.wikipedia.org/wiki/Reductio_ad_absurdum https://en.m.wikipedia.org/wiki/Reductio_ad_absurdum
- nend 6y agoYou make it sound like the US government is one homogenous voice with one opinion. A republican senator introduced one bill that affects HTTPS, while a completely separate non-legislative government group is advocating for using HTTPS on the sites they control. >Which is it It's both, there's two separate groups advocating for two separate things here.
- happythomist 6y agoThere's a pretty significant difference between "no HTTPS" and "mandatory decryption for consumer electronic devices with a warrant", even if the latter is still a bad policy.
- gentleman11 6y agoThe author of the article (in the hn story) I linked claims that the legislation in question bans https
- happythomist 6y agoI don't see where the author makes that claim. Mandatory decryption of HTTPS traffic is not a ban on HTTPS.
- delecti 6y agoThe government being able to use HTTPS on their sites is not logically inconsistent with a requirement that the government be able to get through any encryption.
- fhqghds 6y agoas someone who works on such things at a .gov, this has been in the works for years, and will likely remain in the works for years the level of push back against it is absolutely epic. the .gov I work on has even been considering moving most services off of .gov to another tld (such as .us) in order to avoid having to comply...
- KeepFlying 6y agoWhat is the reasoning for the pushback? Can you talk about some of the reasons they give for that?
- fhqghds 6y agoshort answer: massive amounts of inertia long answer: there are a lot of reasons... one is that our network is obscenely open and used in weird ways. public ips handed out to all the things via dhcp. dynamic hostnames (generated from the dhcp request) on a subdomain of our .gov for all the things. similarly static ips and top level dns records on our .gov are passed out like candy. the border is heavily firewalled, and all networks are heavily sniffed and monitored, but everyone has a public ip with a .gov hostname. the network users consist of thousands of academics and scientists who use the network in fun an interesting ways, frequently without tls. changing this culture is likely way more difficult than making config changes on bind and dhcpd I've slowly learned to stop asking, and just try to keep my sobbing down during calls
- annoyingnoob 6y ago> United States wants HTTPS for all government sites, all the time But they want to backdoor the encryption so that foreign governments can spy on those encrypted connections. Genius.
- thephyber 6y agoTo be fair, not all of the United States government wants to be on HTTPS (all that quickly) and not all of the government wants to backdoor encryption. I think it's important to point out that some of the US Government has a more tempered approach to the issue. The NSA tends to ignore the domestic quibbles about encryption because they tend to have much more flexibility in how they work around encryption hurdles. The DOJ and local police departments scream bloody murder about encryption everytime there is one phone they can't access and a few congress Critters use that call as a political wedge issue.
- annoyingnoob 6y agoProponents of backdoors are beating the drum louder, harder, and more often as time goes on. They are playing the long game. It seriously concerns me that morons want to take us in the wrong direction.
- stx 6y agoI expect to see more government sites for which https is on but the cert is expired or does not validate.
- eddietejeda 6y agoHi, I work on infrastructure in the federal government. Here's my take: the title is unclear. The federal government has required https for a while. Learn more here: https://https.cio.gov/ https://https.cio.gov/ OMB wrote a memo requiring https in 2015: https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2015/m-15-13.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/me... If you see the "announcement" linked in the article, you'll notice that it's referencing this page: https://home.dotgov.gov/ https://home.dotgov.gov/, which is about the HSTS preload list.