4 ms·

> The push towards forced HTTPS has significant costs, which most people in this filter bubble don't want to honestly discuss. I agree, but I'll push back by s

> The push towards forced HTTPS has significant costs, which most people in this filter bubble don't want to honestly discuss. I agree, but I'll push back by saying that delaying HTTPS adoption and getting lax about it has a much higher cost -- and that is similarly a cost that most people pushing back against HTTPS either downplay or refuse to acknowledge. And more than that, those critics have shown that they're not interested in solving the problems that they bring up or in finding ways to mitigate them. So it's not like we can wait a year and adoption will suddenly get easier. The critics of HTTPS aren't moving forward. They don't want HTTPS adoption to slow down while they catch up, they want it to stop so that they don't need to move forward at all. We've seen significant improvements in usability for HTTPS for ordinary people, from LetsEncrypt, to Cloudflare, to Netlify. Holdouts like Gitlab and Github don't provide an easy way to provision certs by default. A lot of other smaller hosting providers are ignoring the problem entirely. This will get better over time as more hosting providers realize that this is a feature they have to provide to be competitive. But that's the thing. Smaller hosts are ignoring the problem and they will continue to ignore the problem until they're forced to upgrade their infrastructure to support solutions like Certbot. Because MITM attacks aren't their problem, client privacy isn't their problem. They are not going to get better support until they literally don't have any other option. That changes our calculations; where a decade or two ago we might honestly argue that immediate, harsh incentives to switch to HTTPS had too many downsides, we're now in a position where we realize that harsh incentives are the only way that HTTPS infrastructure is going to improve at all. And that has significant implications for people's privacy and security online. We're at the point where even though it's a barrier of entry for some people, everyone should still be using HTTPS on any public site that they build, period. Honestly, I'm in the process of trying to find good HTTPS schemes for intranet sites too. We need to move forward on security.

sumtechguy 6y ago
To add to that https I think is one part of the puzzle. This weekend I watched a bunch of scam bait calls. Very amusing to watch them get taken down. But there are people out there mailing 20k in fedex boxes to scammers. All because their browser said 'your balance is 20000 and I transferred too much to the account, could you mail that back to me so I do not get in trouble?'. It is a very human attack using a combination manipulation, fear and compassion. The bottom line is these people unknowingly allowed people to open the debug console in their browser to change things. What I have been trying to figure out in my head is how do we do a digital watermark on data presented to the user? How do we at a minimum tell the user their data has been manipulated? You can have all the TLS on every level but at one of the most important ones there is nothing. A scammer can open a debug console on a https presented page just as much as a http page.
foosome 6y ago
Cloudflare does MITM. MITM is cited as a reason in this thread for force HTTPS upon everyone, even on static blog pages. Kind of ironic.
- detaro 6y ago
  In the same way that any webhosting company "does MITM", your loadbalancer "does MTIM", ... The term makes little sense for a party that's explicitly part of the hosting infrastructure a site owner choose to handle HTTPS.
- danShumway 6y ago
  Not ironic at all. An explicit caching server that I integrate into my site on purpose is a totally different category of device from a random router sitting in an airport. This is like arguing that because Linode can log into my server and examine/edit my files, then we might as well stop requiring a password when random people online try to SSH onto the machine. Trusted agents and untrusted agents are not the same.
colllectorof 6y ago
>And that has significant implications for people's privacy and security online. We're in a thread about Google making changes to Chrome. The irony of trying to somehow tie this to user privacy is hilarious.
- danShumway 6y ago
  Google is not the only company pushing for these changes, every mainstream browser is trying to increase HTTPS adoption. And you shouldn't be waiting for them to do so, you should already be running the HTTPS everywhere addon[0] in your browser today. The overwhelming consensus in the security industry is that end-to-end encryption increases security and privacy. Overwhelmingly, security professionals recommend using HTTPS. Of course it's tied to user privacy, there are multiple examples of not just malware authors but also corporations like Verizon, public wifi administrators for large establishments, doing sniffing and MITM attacks on non-HTTPS traffic. It's absurd that E2E encryption in the browser has to be defended to people, it is absolutely a privacy and security issue. I dislike Google's privacy stances too; I'm regularly on the Google hate train. But if you're leaving your Internet traffic unencrypted just because Google is one of the companies telling you to encrypt, then you are pointlessly cutting off your nose to spite your face. [0]: https://www.eff.org/https-everywhere https://www.eff.org/https-everywhere

sumtechguy 6y ago

To add to that https I think is one part of the puzzle. This weekend I watched a bunch of scam bait calls. Very amusing to watch them get taken down. But there are people out there mailing 20k in fedex boxes to scammers. All because their browser said 'your balance is 20000 and I transferred too much to the account, could you mail that back to me so I do not get in trouble?'. It is a very human attack using a combination manipulation, fear and compassion. The bottom line is these people unknowingly allowed people to open the debug console in their browser to change things. What I have been trying to figure out in my head is how do we do a digital watermark on data presented to the user? How do we at a minimum tell the user their data has been manipulated? You can have all the TLS on every level but at one of the most important ones there is nothing. A scammer can open a debug console on a https presented page just as much as a http page.

foosome 6y ago

Cloudflare does MITM. MITM is cited as a reason in this thread for force HTTPS upon everyone, even on static blog pages. Kind of ironic.

detaro 6y ago
In the same way that any webhosting company "does MITM", your loadbalancer "does MTIM", ... The term makes little sense for a party that's explicitly part of the hosting infrastructure a site owner choose to handle HTTPS.
danShumway 6y ago
Not ironic at all. An explicit caching server that I integrate into my site on purpose is a totally different category of device from a random router sitting in an airport. This is like arguing that because Linode can log into my server and examine/edit my files, then we might as well stop requiring a password when random people online try to SSH onto the machine. Trusted agents and untrusted agents are not the same.

colllectorof 6y ago

>And that has significant implications for people's privacy and security online. We're in a thread about Google making changes to Chrome. The irony of trying to somehow tie this to user privacy is hilarious.

danShumway 6y ago
Google is not the only company pushing for these changes, every mainstream browser is trying to increase HTTPS adoption. And you shouldn't be waiting for them to do so, you should already be running the HTTPS everywhere addon[0] in your browser today. The overwhelming consensus in the security industry is that end-to-end encryption increases security and privacy. Overwhelmingly, security professionals recommend using HTTPS. Of course it's tied to user privacy, there are multiple examples of not just malware authors but also corporations like Verizon, public wifi administrators for large establishments, doing sniffing and MITM attacks on non-HTTPS traffic. It's absurd that E2E encryption in the browser has to be defended to people, it is absolutely a privacy and security issue. I dislike Google's privacy stances too; I'm regularly on the Google hate train. But if you're leaving your Internet traffic unencrypted just because Google is one of the companies telling you to encrypt, then you are pointlessly cutting off your nose to spite your face. [0]: https://www.eff.org/https-everywhere https://www.eff.org/https-everywhere