11 ms·
The First Few Milliseconds of an HTTPS Connection (2009)
- gulbrandr 6y agoThe Illustrated TLS Connection guide is also really useful https://tls.ulfheim.net/ https://tls.ulfheim.net/
- qntmfred 6y agohttps://howhttps.works/ https://howhttps.works/ also interesting
- tialaramex 6y agoNB Like this 2009 article, that cartoon is explaining a mechanism which is now obsolete. Your browser still knows how to do things that way (for at least a while yet), but it would rather not because it's less safe for you. The TLS 1.3 walk through somebody else linked represents more or less what an actual browser does when talking to many popular sites, and even though TLS 1.3 isn't a majority of sites yet the behaviour for most (but not all) TLS 1.2 sites now more resembles that than these older articles in crucial ways. Most essentially, we do not do RSA kex (client picks random secret, encrypts it with RSA, sends it to the server, thus implicitly verifying the server knows the RSA private key) unless that's the only permitted way to get access. For whatever reason people like explaining RSA key exchange, long after we don't like using it because it isn't Forward Secret.
- ktpsns 6y agoThis is such a beautiful and cute comic! I love it!
- Biganon 6y agoAnd up to date (TLS 3.0, which is massively different)
- tialaramex 6y agoThere is no TLS 3.0. The published standard is TLS 1.3, even though it's fundamentally quite different from TLS 1.2 and in the end it wasn't even possible to re-use the version system from TLS 1.2, the standard is still named TLS 1.3
- Biganon 6y agoBrainfart. I remembered the 3, and misplaced it.
- deleted 6y ago[deleted]
- phnofive 6y ago(2009)
- dang 6y agoAdded. Thanks!
- hannob 6y agoPlease note that this is from 2009 and a lot of things have changed. If you read it consider it a history lesson of how TLS was in 2009, not how it is today.
- javajosh 6y agoIt would be useful if you were to list at least some of the things that have changed.
- shawabawa3 6y agoI guess they're referring to http/2, http/3 and quic?
- hannob 6y agoThe most obvious thing being that it describes primarily RSA-handshake and RC4 encryption. For good reasons these aren't used any more. But there's plenty of tiny details that are obsolete as well, e.g. it describes the timestamp which is no longer used and usually filled with random data these days.
- londons_explore 6y agoIt's a shame the clients timestamp is no longer sent to the server. If it was, a server could compensate for a client clock being wrong by many decades by providing an old expired certificate.
- spockz 6y agoIf this was the behaviour of an app up to 2009 you could at least serve certificates to those apps still.
- forgotmypw17 6y agoThis is one of the reasons I still use http primarily and do not promote https. There are many barriers to an https connection, and this is one of them. Another is the version race, meaning browsers as recent as 2012 are no longer compatible with today's https sites.
- tomschwiha 6y agoI like how the blog page itself is on http.
- nicexe 6y agoIt is also served for https
- superkuh 6y agoHTTP and HTTPS are not mutually exclusive. They're synergistic. The idea that a hypothetical downgrade attack is enough justification to kill off HTTP everywhere is incredibly business-centric and stupid. Most sites are not transacting currency or private information. A centralized cert is just that, centralized. Even if it's LetsEncrypt that's still a single point of failure for organizational corruption (ie, what happened to dot org), accidents (as cert providers mess up regularly) and government control. It's a long leash but if HTTPS is the only option (as is the trend) it's still a leash. Almost all sites should be HTTP and HTTPS.
- cnst 6y ago> Most sites are not transacting currency or private information. > Almost all sites should be HTTP and HTTPS. This. Most people aren't even aware that Google.com is still both HTTP and HTTPS; you can easily test with curl or lynx to verify yourself. If your browser doesn't support HTTPS (e.g., maybe its blocked in your library or another free wifi), then Google.com would still work just fine. (Another question is that many other sites aren't as easily available, sadly.)
- account42 6y agoYet chrome doesn't let others on the HSTS preload list if you don't force all users onto HTTPS.
- ktpsns 6y agoI like how this ironic sentence is still 100% valid in today's world, 10 years later (2009-2020): > This is a way to tell Amazon.com that our browser is trying to reach https://www.amazon.com/ https://www.amazon.com/. This is really convenient because our TLS handshake occurs long before any HTTP traffic. HTTP has a “Host” header which allows a cost-cutting Internet hosting companies to pile hundreds of websites onto a single IP address. SSL has traditionally required a different IP for each site, but this extension allows the server to respond with the appropriate certificate that the browser is looking for. If nothing else, this extension should allow an extra week or so of IPv4 addresses. Extra week? More of a few extra decades!
- fedache 6y ago#lekkimassacre, we are dying. https://twitter.com/OsAsthaEdoBoy/status/1318893637724524549 https://twitter.com/OsAsthaEdoBoy/status/1318893637724524549
- kuharich 6y agoPast comments: https://news.ycombinator.com/item?id=650914 https://news.ycombinator.com/item?id=650914, https://news.ycombinator.com/item?id=6295146 https://news.ycombinator.com/item?id=6295146
- dang 6y agoIf curious see also 2013: https://news.ycombinator.com/item?id=6295146 https://news.ycombinator.com/item?id=6295146 Discussed at the time: https://news.ycombinator.com/item?id=650914 https://news.ycombinator.com/item?id=650914