9 ms·
How HTTPS Works
- kzrdude 6y agoUnsolicited constructive criticism is that I think the comic could do with a bit more spacing between the panels, it gets easier to read feels less dense that way - that's what I think.
- kirillzubovsky 6y agoYeah, I agree. It's easier to read if you zoom out the page a bit, but perhaps more spacing and slightly visible edges around each box would make it easier to consume.
- leptons 6y agoI have some different constructive criticism. I felt like the cartoons made it seem like they were treating me like a 5 year old. Is this for adults or children? I had to click away, it was a little bit insulting honestly.
- ohyeshedid 6y agoIf it was made for children, would you still find insult?
- leptons 6y agoDo you think SSL encryption is really a subject for children? I'm talking about ~6 year olds, the cartoons seem geared towards 6 year olds. Infantilism isn't really attractive, this "guide" is practically the same as an adult persistently talking in a baby voice. Sorry if the truth hurts.
- bryanrasmussen 6y agoIn my experience with 6 year olds if you use words like eavesdrop you then have to explain what it means, so I don't think linguistically the comic is geared towards 6 year olds. What it does do is use a cartooning style that seems similar to the cartoons one might find at the dentist about why you should always floss your teeth or the cops hand out about why you must never talk to strangers. Thus it is somewhat ironical in the cartooning style it uses. I admit that someone could find this tedious but other people can admire it as a stylistic conceit (although admire is maybe too strong a word )
- ohyeshedid 6y agoMaybe the content isn't for you, or made with you in mind. I don't understand why you wouldn't just change the channel on something as benign as this, rather than find the time to be insulted. Different strokes, I guess.
- leptons 6y agoI did "change the channel". I hit the back-arrow after reading "Compugter" and "Certificat" and wrote an honest comment about how bad an idea this infantile comic is, and questioning what audience it serves. In my opinion, it's a confused mess. I really hope this won't be a trend in tech, because it's honestly pretty awful. But I'm curious how you see it.
- tialaramex 6y agoA six year old is both inquisitive about the world and capable of learning about it so I don't see any less reason you should be prepared to talk to them about TLS than any other topic they might express curiosity about. You have to pitch things appropriately. A six year old who has just noticed that some of her contemporaries have penises and some don't probably does not want a diatribe about Trans Exclusionary Radical Feminism and if she's wondering about TLS she probably doesn't need an excursion on ECC Safe Curves, but with care to stay relevant and not just blast her with jargon she doesn't understand there's no reason any topic needs to be off the menu.
- leptons 6y agoPlease, someone show this to a 6 year old and let me know long they stay focused on the topic and how much they actually understand about TLS after reading this. It would be hilarious if this were a youtube video, too. Sorry but I just don't believe any 6 year old is going to be interested in TLS or really learn much except how to mispronouce "computer" as "Compugter".
- newyorker2 6y ago>Do you think SSL encryption is really a subject for children? Yes. ps: I find it insulting that you find a random illustration insulting. Re-asses your thought process, I'll wager a guess you're better than this.
- leptons 6y agoDo you like it when people treat you like a 6 year old? No? Or maybe you do? You're probably better than that. I honestly have no idea what kind of adult thought process is okay with being treated like a 6 year old, as this comic attempts to do. I honestly am better than that - but it sounds like maybe you're okay with it??
- newyorker2 6y agoGood introspection. You're almost there.
- leptons 6y agoYou've done nothing but troll.
- encom 6y agoOn the other hand, adults are buying colouring books and superhero toys now. Infantilism is some kind of new strange/creepy marketing vector? I dunno.
- hn_throwaway_99 6y agoWhile I don't like to be overly harsh to submissions, I'm afraid I agree. For contrast, check out the original comic that announced the Chrome browser [1]. I was amazed by it's effectiveness in telling a detailed story, but I never felt talked down to. I felt this comic lived in a different kind of uncanny valley, where the verbiage felt Barney/Sesame Street-esque but the topic was clearly geared toward adults. [1] https://www.google.com/googlebooks/chrome/ https://www.google.com/googlebooks/chrome/
- yellowcabinet 6y agoSame here, it omits some of the basic principles of comics. Outlines, contrast, spacing, context. It overly introduces some characters (certificat, compugter, browserbird), but then suddenly there is a regular crab. If you'd look at the Oatmeal[1], even though his style is absolutely chaotic it's still a lot easier on my eyes/mind to focus. I also don't want to be harsh and I love the initiative and the effort, but if it would be a bit easier to read I'd bookmark it and show it to every new trainee. [1] https://theoatmeal.com/comics/mantis_shrimp https://theoatmeal.com/comics/mantis_shrimp
- megraf 6y agoThis is a really cute and informative page. Bravo
- LaFolle 6y agoGreat demonstration! I wrote a bit on it few days back- https://lafolle.ca/blog/broken-resolution/ https://lafolle.ca/blog/broken-resolution/
- cnst 6y agoI'm getting an SSL negotiation error. I don't think it works. They might want to have their SSL checked out.
- aeden 6y agoCould you provide some details so we can look into this. Specifically what browser and OS you are using, and any customizations you've made in your browser. FWIW, the site is hosted on Cloudfront using an Amazon issued certificate. Here's some debug output I show using curl which shows successful negotiation: * Trying 13.227.219.41... * TCP_NODELAY set * Connected to howhttps.works (13.227.219.41) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: /etc/ssl/cert.pem CApath: none * TLSv1.2 (OUT), TLS handshake, Client hello (1): * TLSv1.2 (IN), TLS handshake, Server hello (2): * TLSv1.2 (IN), TLS handshake, Certificate (11): * TLSv1.2 (IN), TLS handshake, Server key exchange (12): * TLSv1.2 (IN), TLS handshake, Server finished (14): * TLSv1.2 (OUT), TLS handshake, Client key exchange (16): * TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1): * TLSv1.2 (OUT), TLS handshake, Finished (20): * TLSv1.2 (IN), TLS change cipher, Change cipher spec (1): * TLSv1.2 (IN), TLS handshake, Finished (20): * SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256 * ALPN, server accepted to use h2 * Server certificate: * subject: CN=howhttps.works * start date: Feb 14 00:00:00 2020 GMT * expire date: Mar 14 12:00:00 2021 GMT * subjectAltName: host "howhttps.works" matched cert's "howhttps.works" * issuer: C=US; O=Amazon; OU=Server CA 1B; CN=Amazon * SSL certificate verify ok.
- cnst 6y agoCheck your SSL score. If you've got an A or A+ or such, it means many people can't connect to your site. Not every browser has TLSv1.2. The maximum score is something like A- nowadays. NH works, your site doesn't.
- fvold 6y agoThe "left clap" is the server's left, and the "right clap" is the server's right. Easy to get those mixed up, as the comic doesn't specify.
- kzrdude 6y agoI'm wondering how the integrity part of HTTPS works. It seems it's an authenticated encryption mode that does it, for example AES-GCM or a MAC as in ChaCha20 + Poly1305
- dryd 6y agoIf you enjoyed this, check out https://howdns.works/ https://howdns.works/ by the same authors.
- abledon 6y agotheir site footer only links the howdns.works not howhttps.work ?
- Tsiklon 6y agoEntertaining irony; I couldn’t resolve the A record for that domain from my pi-hole and nearly wrote an embarrassing comment here before I checked another resolver. All sorted now though
- guru4consulting 6y agoIt's well done, helpful especially for non-technical folks or beginners. But I'm annoyed with using the dnssimple.com as example site along with name servers at ns1.dnssimple.com . So, a newbie may wrongfully assume that example.com may have name servers like ns1.example.com which is not the case. May sound silly, but any one totally new to the DNS could easily misunderstand it. They could have used example.com to avoid any ambiguity.
- jkchu 6y agoThanks for sharing, I found it really cool and informative. Also, just a great example of an innovative marketing strategy: provide legitimate value to people who are part of your target market.
- tumidpandora 6y agoPlain awesomeness! had a good laugh and learnt a good deal about https. Thanks OP.
- jwcrux 6y agoI love seeing comics like this that aim to show concepts in simple ways. Kudos! Worth noting that "The Handshake" episode [0] covers the key exchange using RSA. This has the downside that it doesn't support forward secrecy, meaning if an attacker ever compromises the server's private key they can retroactively decrypt traffic they previously captured. It's more common these days to use an ECDHE exchange in which the client and server exchange keys that are generated just for this session (or at least, they should be [1]) and use those to generate the "shared secret". In fact, in TLS 1.3 ECDHE is the only key exchange mechanism. [2] The server then uses its long term keypair corresponding to the certificate to sign all the handshake messages that were seen previously [3]. [0] https://howhttps.works/the-handshake/ https://howhttps.works/the-handshake/ [1] https://raccoon-attack.com/ https://raccoon-attack.com/ [2] https://blog.cloudflare.com/rfc-8446-aka-tls-1-3/ https://blog.cloudflare.com/rfc-8446-aka-tls-1-3/ [3] https://tools.ietf.org/html/rfc8446#section-4.4.3 https://tools.ietf.org/html/rfc8446#section-4.4.3
- kyawzazaw 6y agoCheck this out! https://maggieappleton.com/api https://maggieappleton.com/api
- beaker52 6y agoThis is really great. I was flapping around trying to explain this to my curious, yet-not-technical wife just the other day. This'll do nicely as a follow up, thank you!
- hannob 6y agoYeah, it's a bit of a pet peeve of mine to complain that so many people who start "easy crypto explanations" basically explain things that are outdated or sometimes simply wrong. This is not how HTTPS works, it's how HTTPS used to work long ago. What makes it even more frustrating is that they do mention that there are different versions and the very latest version is 1.3, but don't mention that what they just explained is a variant of TLS 1.2 that most people have deprecated long ago.
- austincheney 6y agoA pointlessly unnecessary nitpick that doesn't invalidate anything: The comic uses the more common term privacy when the more appropriate term confidentiality is more appropriate. Privacy is more a legal term than a term of technical control. The distinction is not frequently appreciated because there is a massive ton of overlap, but the distinction is important in the authoring of policy guidance and legislation as the enforcement actions can greatly differ. https://en.wikipedia.org/wiki/Privacy https://en.wikipedia.org/wiki/Privacy
- deleted 6y ago[deleted]
- naniwaduni 6y agoPrivacy is a social norm; it happens to have some not-exactly-matching instantiations in law. Mistaking the two is dangerous.
- CommieDetector 6y agoFor IoT devices it does not.
- ancarda 6y ago>Crab is listening on the communication capturing the message. Can we stop here and have a discussion about this? Every example I have ever seen of interception is either "coffee shop Wi-Fi" or government surveillance. Are those the main threats? "Coffee shop Wi-Fi" seems like less of a threat each year. AFAIK WPA 3 means you get an ephemeral encryption key when you connect. Additionally, tethering seems to be more and more common these days. Both solve this problem, no? Government surveillance is a different topic, but given how prevalent TLS termination is (any website using CloudFlare, for a start), I'm not so sure it helps - the NSA probably still have all your data. Who is crab nowadays? Is he still a threat? Do we still need TLS even with WPA 3?
- chronial 6y agoThe coffee shop router is the thread. Whether it's the coffee shop owner, an employee, somebody who hacked the router or just somebody who tricked you into going into their WiFi which is not actually the coffee shop's.
- ancarda 6y agoI don't have data on this, but I suspect usage of public Wi-Fi is going to keep declining in favor of cellular data as it becomes cheaper and data caps rise/go away So, in that case, would TLS still be useful? It just seems like quite a lot of effort to ensure TLS everywhere because a small number of people use untrustworthy Wi-Fi networks
- cheph 6y ago> So, in that case, would TLS still be useful? Because again the scope of encryption offered by wireless operators is different from TLS. It is like asking if encrypting your disks makes TLS pointless. TLS encrypts traffic between your computer, and some resource on the internet. WPA3 encrypts communication between your computer and the wireless access point, no further. The wireless provider's encryption will similarly only encrypt data between your device and the wireless provider's equipment. They are not designed to do the same thing. Technically WPA3 and and other wireless networking encryption is not needed if you are using TLS, because the scope of encryption of TLS covers the data going to your wireless provider or the wireless access point, but not everything is TLS - and even TLS still leaks DNS in many cases. And even if it was not leaking DNS there are still things that would be better for others to not know when you are using TLS.
- Infiltrator 6y agoI really enjoyed reading this, but I felt like the characters used throughout the comic weren't particularly representative of the things they're trying to represent (mainly attacking Browserbird here). This made it slightly harder for me to digest. All the same, informative and fun. I enjoyed it! :-)
- Biganon 6y agoI found this comic very good and useful, but I'm a bit disappointed by two things: 1) the fact that it doesn't spend much time explaining what happens after the client generates a pre-master key. Diffie Hellman seems to be pretty standard, but it's nowhere to be seen here. Also, how do the client and server agree on a shared key if the secure communication only goes one way at this point? How can the server securely answer to the client, if the client hasn't sent an actual public key? In other words, how could they do the DH step (not explained itself in the comic) if a MITM attack is possible at this stage? I always assumed the client generates a temporary public key for itself and sends it (encrypted with the server's public key) to the server, but I'm not sure at all. 2) I was glad to see a quiz, but sadly most questions are too easy, with 1 serious answer and 3 completely ludicrous ones. Doesn't really challenge your knowledge. Excellent work however.
- tialaramex 6y agoActually ordinarily today we do DH first and there is no step where the Pre Master Secret is actually sent at all - unlike this comic. Magic! DH allows them to agree a random secret and since we wanted a random secret anyway that's fine. The server ends up with no assurance as to who the client is in typical day-to-day HTTPS. You could be anybody, which is why web servers use technologies like passwords. TLS can be used in a mutually authenticated mode where both sides present certificates, but that's not how HTTPS is ordinarily done. So why is this any help? Well after DH neither side knows who the other is but whoever they both are they now have a secret in common. This is enough to send messages back and forth that nobody else can eavesdrop or tamper with. Now the server can use this secure channel to show a certificate for its identity and present a proof bound to this session, in the form of a signature over the transcript of the handshake so far. The client examines the certificate, the certificate should be satisfactory (e.g. for https://www.google.com/ https://www.google.com/ the certificate with SAN dnsName www.google.com issued by a CA you trust seems satisfactory) and then the transcript signature can be verified with the public key listed in the certificate. So now the client is satisfied that this is, in fact, www.google.com it is talking to.
- dpcan 6y agoI see a lot of love for this, but there always has to be the other side. I found this to make it SO MUCH MORE CONFUSING than just explaining how HTTPS works using words like Computer, Browser, Certificate. My brain could not wrap around the concept of a ComPUGtor or whatever. But I'm sure this works for some people - just think the site should have a "lose the comics" format.
- dudus 6y agoI commend you for taking the time to translate the material to different languages. We really lack good learning material in languages like Portuguese. This helps a lot.
- kirillzubovsky 6y agoFrom what I heard the translations actually came from customers who read the comic in English and then wanted it to be available in their language.
- catoc 6y agoFunny. But confusing - to me at least - is the naming of browserbird and compugter. Half of the time (I think?) browserbird is not a browser but a person; same with compugter. Alice and Bob would make things clearer.
- greg0ire 6y agoIn https://howhttps.works/the-keys/ https://howhttps.works/the-keys/ The public key is represented by a blue key but… wouldn't it be more simple to say the public key is an open padlock the sender closes on the box after putting their message in it? Padlocks can only be open by one key, the private one.