7 ms·
>HTTPS-Only mode ... will also ask for your permission before connecting to a website if it doesn't support secure connections. This is being done with the bes
by superkuh 6y ago
>HTTPS-Only mode ... will also ask for your permission before connecting to a website if it doesn't support secure connections.
This is being done with the best of intentions but browsers scaremongering over HTTP sites as if they are dangerous is a bad thing. There is more to the web than commercial transactions!
Human people cannot feasibly be cert authorities. Only corporations can. When browsers will only display sites that are authorized by corporations we're eventually going to be in big trouble. Yes, LetsEncrypt is a benevolent corporation, yes there are even options beyond LE, but as we know from the dot org fiasco as long as there is potential money to be made these benevolent dictorships will eventually go very bad. And that's ignoring all centralization making a very juicy target for government censorship.
Encrypt, yes. But also allow plaintext. The potential for a down-grade attack on a "secure" site is worth far less to the world than being able to communicate person to person without a corporate intermediary approving every bit.
- jackconsidine 6y agoNot to mention many non-https sites have zero reason to be. A plain HTML portfolio site, for example, should not be flagged with a scary "insecure" logo because its content is not encrypted.
- lol768 6y agoWe need to protect the integrity of the information so that kit's not abused to serve malware or pages that exploit zero-day vulnerabilities to the end-user when they browse on an insecure network (which, if Snowden's publications are anything to go by, is every network). HTTPS is not just confidentiality - security is confidentiality, integrity and availability.
- pbalau 6y agoHaving a valid ssl cert does not stop a website from serving malware.
- yjftsjthsd-h 6y agoNo, but it stops third parties from adding it
- pbalau 6y agoNo it doesn't.
- netizen-9748 6y agoWould the third part not need to serve a valid cert to do this? I'd like to hear if it is easier or harder to do with http vs https
- yjftsjthsd-h 6y agoYes, you'd need either a valid cert, or for the user to click through the big scary warning to accept the invalid (or self-signed) cert, either of which raises the bar way above unencrypted HTTP, where this attack is trivial (ex. https://en.wikipedia.org/wiki/Firesheep https://en.wikipedia.org/wiki/Firesheep and https://stopthecap.com/2013/04/03/isp-crams-its-own-ads-all-over-your-capped-internet-connection-banners-block-your-view/ https://stopthecap.com/2013/04/03/isp-crams-its-own-ads-all-... )
- yjftsjthsd-h 6y agoOkay, I'll bite. Let's say I'm loading a page over https, and you control the network but not the server (mitm). How exactly are you adding content to the page?
- superkuh 6y agoAttack the client's (or some sub-population of clients at some ISP) DNS resolver and point it towards other IPs that serve up a clone of the web interface with their own LE signed HTTPS but now with some new content too. This is the same argument technique being used when people say, "Oh, but you can MITM HTTP!" Yes, a target attack of something beyond your webserver is bad. But it applies to HTTP and HTTPS.
- Hedja 6y agoHTTPS ensures the data isn't tampered during transport, but it doesn't ensure the integrity of the data itself. That's why there's things like Subresource Integrity (which doesn't apply to top-level resources like HTML). However, there's no way to ensure the files we download are created by who they say they are. A domain for example can change hands and existing links say on HN can be loaded with unexpected, potentially malicious, content. Same for hacked servers. IMO we need some form standard page signing to enforce actual integrity of information, not just transport. I made a proof-of-concept Web Extension to show how that might be possible using PGP [1]. Of course PGP has its own issues but it's just an experiment. [1] https://webverify.jahed.dev/ https://webverify.jahed.dev/
- hoytschermerhrn 6y agoCerts can be purchased for the price of a coffee or two and are generally trivia to implement — there’s really no reason NOT to upgrade these days, no matter how benign the content. And I say that as someone who still has a non-HTTPS portfolio site :)
- ncmncm 6y agoAnd, therefore, a cert is about as meaningful as a coffee or two. Someone not attesting the validity of the data served from their site is, effectively, lying if they provide a cert.
- yjftsjthsd-h 6y agoWhat exactly do you think https certs do?
- ncmncm 6y agoNot very much. That is the point.
- AsyncAwait 6y agoHTTPS also protects against spying on the specific sub-page you're on for example. That's valuable. Besides installing a Let's Encrypt cert is straightforward these days.
- forgotmypw17 6y agoaccessibility is important too. privacy is already a lost cause today for all but the ultra vigilant techies, and https won,t help much there.
- yjftsjthsd-h 6y agoAnd, congrats, your portfolio now has injected banner ads and was used to deliver a drive-by exploit. HTTPS is confidentiality and integrity.
- belltaco 6y agoWhy can't the portfolio page inject banner ads via HTTPS?
- yjftsjthsd-h 6y agoBecause the modified page wouldn't be signed with that key? This is one of the basic things https does
- fgonzag 6y agoI don't really agree. Firefox itself could run a free Certificate Authority if it ever came to that. Your scenario is much less likely, and much more easily fixable than the status quo where most websites don't bother exposing their site over HTTPS, creating huge security and privacy risks for consumers of said sites. There is absolutely no reason not to have your site functioning over HTTPs these days, except negligence.
- tetris11 6y agotry running `python3 http.server 8080` on a safe directory on your laptop, and see if you can easily access a file from it from your mobile. With Firefox for Android, it doesn't permit you to connect a machine on your own LAN, even if you try to add an exception. With stock browser it does. I'm sure there are better ways to serve a file between machine and phone, but that python snippet was my easiest goto. No more
- fgonzag 6y agowouldn't it be much easier to use scp for that? there are plenty of android clients, and plenty of windows servers. I just actually use synced storage (Synology Drive from a Synology NAS), so I would probably use a Dropbox like service for that functionality. There's an app called droid transfer that basically does what you did with python (setup a server and have a simple download client), and there's also wireless ADB (which will require you to use the USB cable for the initial setup)
- s_gourichon 6y agoI think the point is e.g. being able to quickly share a file with a smartphone nearby, that is not yours. Not telling your co-workers to install on their phones some app foreign to them.
- yjftsjthsd-h 6y ago? I just tried it and it works fine. Firefox 84.1.1 on Android, connect to 192.168.x.y:8080 and it comes up and shows me a directory listing that I can navigate and open files from. (you missed the -m, BTW; it's `python3 -m http.server 8080`)
- roca 6y agoOne reason to always use HTTPS is that HTTP connections can be hijacked to carry out DDoS attacks. See https://en.wikipedia.org/wiki/Great_Cannon https://en.wikipedia.org/wiki/Great_Cannon
- auggierose 6y agoTotally agree. I have an iPad app that runs an embedded http server, so that other clients on the same lan can connect to it. Making that into an embedded https server would be a big hassle.
- chrisseaton 6y ago> Making that into an embedded https server would be a big hassle. Why? HTTPS is an open protocol anyone can implement.
- jackewiehose 6y agoIt's still a much bigger hassle to implement HTTPS than just HTTP.
- chrisseaton 6y agoDon't your libraries implement it?
- cpeterso 6y agoThe biggest hassle would be that the embedded HTTPS server needs a trusted certificate, but certificates are only issued for hostnames, not IP addresses. So the embedded HTTPS server's certificate and LAN clients would need to know the hostname of the device running the app.
- cxr 6y agoCloudflare manages to provide a certificate for https://1.1.1.1 https://1.1.1.1. (But not reserved ones; see [1].) Aside from that, what is the purpose of this comment supposed to be? (The general tone reads as if its meant to refute the parent; did you intend it to be a reply to chrisseaton instead—and thus a defense of the HTTPS-complicates-things position?) 1. https://news.ycombinator.com/item?id=16717849 https://news.ycombinator.com/item?id=16717849
- 6y ago
- forgotmypw17 6y agohttps creates many barriers for accessibility, and i agree completely. https is helpful but also a tool for more centralized control.
- jackewiehose 6y ago> When browsers will only display sites that are authorized by corporations we're eventually going to be in big trouble Likewise they removed support for unsigned add-ons. So you can't just write a small private add-on without sending them your private(!) code. Who needs freedom when you are so well "protected" :-(
- captn3m0 6y agoI turned this on recently, and I don't think its a good idea, unless you're risk profile demands in - in which case you should be using something like Tails perhaps. One interesting find was that close to 100% of all email tracking links are still on HTTP. None of the major email providers support HTTPS easily for those.
- nine_k 6y agoGenerating a local CA and installing its certificate into the local browser(s) is not hard. Not harder than setting up an HTTP server on your LAN. OTOH localhost is finally exempt from the "not https" warning.
- robscallsign 6y agoI live in a rural area in North America, a stones throw away from a municipality of 160,000 people, and our internet is marginal. The constant push for https everywhere is making the web almost unusable for us. Https is being used to deliver fonts, javascript libraries, and images also over https from multiple domains all requiring multiple ssl negotiations. Usually one of these fonts/js/images times out, and as a result the entire page doesn't load.