7 ms·
HN now comes with HTTPS?
- mike-cardwell 15y agoThe Firefox addon HTTPS Finder just alerted me to the fact that there was an HTTPS version of the site at https://news.ycombinator.com/ https://news.ycombinator.com/ - I tried it out, and it worked. Nice work. EDIT: Session cookie needs to be set as "secure" and Strict-Transport-Security should be implemented in order to protect against certain attacks. End users can just add this HTTPS-Everywhere ruleset: https://raw.github.com/mikecardwell/https-everywhere/73241d145b7bb8f62d9be2f713baafb622501fce/src/chrome/content/rules/YCombinator.xml https://raw.github.com/mikecardwell/https-everywhere/73241d1...
- profquail 15y agoThanks for the HTTPS-Everywhere ruleset! I've been using HTTPS-Everywhere for a reasonably long time now (a couple of years?) but this is actually the first time I've added a rule...so if anyone else falls into that boat: all you need to do is save the YCombinator.xml file (linked above, from Mike's GitHub) into the HTTPSEverywhereUserRules folder in your Firefox profile folder, then restart Firefox. Hopefully that'll save someone else from having to look it up ;)
- NickBomb 15y agoThanks for saving me a minute or two. :)
- EGreg 15y agoCan you elaborate please? What is this "HTTPS everywhere" and why do we need it?
- mtogo 15y agoA really fantastic firefox addon that forces HTTPS on certain sites. https://eff.org/https-everywhere/ https://eff.org/https-everywhere/
- walrus 15y ago> and why do we need it? If you're on an unsecured wireless network (e.g. at a library) and you don't want someone to see your HN password when you log in.
- tobylane 15y agoHere's a silent Chrome version https://chrome.google.com/webstore/detail/flcpelgcagfhfoegekianiofphddckof https://chrome.google.com/webstore/detail/flcpelgcagfhfoegek...
- mtogo 15y agoWatch out, this extension does not do what HTTPS-Everywhere does! With KB SSL Enforcer, your browser still hits the HTTP version before being redirected to the HTTPS version of the site.
- happyhacker 15y agoNERD ALERT!!!!
- wallflower 15y agoThank you, RTM and PG!!
- deleted 15y ago[deleted]
- k33n 15y agoSeems like overkill to me.
- 46Bit 15y agoOk, why shouldn't we use HTTPS? To me it seems silly that the vast majority of traffic isn't atall encrypted.
- icebraining 15y agoWell, HTTPS adds latency due to its handshake, and of course it uses more CPU, especially on the server (unless a dedicated SSL offloaders is used).
- 46Bit 15y agoAnd yet on the flipside, it should prevent interception of login credentials or page-content filtering.
- icebraining 15y ago> it should prevent interception of login credentials That was already possible using HN's OpenID support and a secure provider.
- mike-cardwell 15y agoOpenID doesn't prevent session hijacking though does it? It would just prevent the credentials being stolen.
- 46Bit 15y ago> That was already possible using HN's OpenID support and a secure provider. Not actually sure what your point is here.
- icebraining 15y ago
- brackin 15y agoThis is great, thanks PG! Only problem for me is that the theme i'm running will no longer work but that's okay, i'm sure they'll update.
- davezatch 15y agoNot sure what kind of theme you're using, but it broke the Greasemonkey script Hacker News OnePage for me. If you're using something like greasemonkey or stylish, you might have to go into the script and tell it to work on https, since the sites are whitelisted with only http. That should do it.
- Joakal 15y agoNifty report of HN's HTTPS: https://www.ssllabs.com/ssldb/analyze.html?d=news.ycombinator.com https://www.ssllabs.com/ssldb/analyze.html?d=news.ycombinato... Grade C it seems
- tptacek 15y agoThese stupid grades kind of drive me nuts, but they really should disable SSL 2.0 and the export ciphers.
- netik 15y agoSSLab's grades are not stupid. They monitor how solid the SSL implementation is and what needs to be corrected to ensure higher security on the site. Another useful tool is SSLScan, which for Hacker News shows that they are accepting of a very strange set of HTTPS cipher and MAC configurations. SSLv2 should be turned off, as well as the majority of 40-bit and 56-bit ciphers. Their unusual preference of CAMELLIA-256-CBC is pretty amusing to me. Prefered Server Cipher(s): SSLv2 168 bits DES-CBC3-MD5 SSLv3 256 bits DHE-RSA-AES256-SHA TLSv1 256 bits DHE-RSA-AES256-SHA Whaaaaat?
- tptacek 15y agoAgree to disagree on the grades, and agree to agree on SSLv2 and export ciphers. (I have other complaints about the SSLabs grades, but I'm not getting into it here).
- dfc 15y agoWhy not? I understand you do not have infinite time but if you get the chance I would enjoy hearing your thoughts.
- yuhong 15y ago>Their unusual preference of CAMELLIA-256-CBC is pretty amusing to me. Yea, I noticed it too when I checked this using Firefox and Chrome.
- pieter 15y agoFor some reason it's now impossible for me to connect over normal http: manila:pieter$ curl -I http://news.ycombinator.com curl: (52) Empty reply from server manila:pieter$ curl -I https://news.ycombinator.com HTTP/1.1 200 OK Date: Sun, 21 Aug 2011 15:09:27 GMT Content-Type: text/html; charset=utf-8 Cache-Control: private
- qjz 15y agoWhen a single IP address can support multiple virtual hosts, probing port 443 for an SSL version of a domain is naive and may trigger an intrusion detection system (IDS). Sure, you may get a response (and even the same content), but that's no guarantee that the domain you used is configured for SSL on the server. An IDS may flag the request as a potentially malicious probe and temporary block the IP address from accessing some resources. This can be extremely useful for blocking exploit attempts by drive-by bots that request by IP address alone. Of course, it would be strange to continue to allow access to the SSL resource as in your example, but maybe there's a reason for it (server admin has different goals than site admin, for example). Just one possible explanation. You might regain HTTP access if you stop hitting HTTPS for a while. Edit: The CN in the cert is news.ycombinator.com, so it's unlikely my explanation is the cause (but still could be).
- pieter 15y agoI only started using HTTPS after HTTP stopped working, so that's probably not it.
- mike-cardwell 15y agoIs it "naive", or is it totally harmless? I've been using HTTPS Finder, which probes for HTTPS versions of websites for quite a while now, without any noticeable negative effects. I'm sure sites out their exist which have this IDS configuration that you describe, but none of the ones I've visited do. As for the positives, I can't remember how many HTTPS versions of sites that it's alerted me to, but it's a lot
- 15y ago
- yahelc 15y agoSo, now the HN effect will be less measurable, as traffic from HTTPS to HTTP doesn't pass a referrer. (This just increases the incentive for sites to use HTTPS Everywhere, so they're not left out in the dark as to who is sending them traffic.)
- deno 15y agoAs a side-effect HN has upgraded from HTTP 1.0 to HTTP 1.1.
- st3fan 15y agoThis is great. It would be even better if HN would use the Strict-Transport-Security header so that browser remember to prefer https instead of http for this site. See http://blog.sidstamm.com/2010/08/http-strict-transport-security-has.html http://blog.sidstamm.com/2010/08/http-strict-transport-secur...
- tptacek 15y agoIf they were taking credit card numbers, STS would be worth the trouble; otherwise, it's not something I'd recommend going out of your way for. For non- HTTPS- nerds: STS resolves the problem where your first contact with a site is via (insecure) HTTP, and a MITM makes all subsequent contacts lie to you about whether HTTPS is available. Since we've lasted many years without even having HTTPS, I think we can all just look at the address bar carefully instead.
- mike-cardwell 15y agoThat is not the only problem it solves. You can go to https://news.ycombinator.com/ https://news.ycombinator.com/, but if you visit any other non-https website at the same time, somebody can MITM that connection, and inject the following HTML into it: <img src="http://news.ycombinator.com/"> That will cause your browser to do a non-https request against news.ycombinator.com (unless STS is implemented), which in this particular case can leak the session cookie, because the session cookie hasn't had the "secure" flag set on it. I'd say that it is worth going out of your way for. If you're implementing HTTPS, it is only slightly more effort to implement STS as well. And it's definitely worth adding the secure flag to the cookie as well.
- tptacek 15y agoNot having the secure flag on a cookie (I didn't look, because I don't care about SSL on HN) is a vulnerability. STS doesn't totally fix that vulnerability. STS: Nice to have. Most installed browsers don't even support it. Cookie Secure flag: Must have. Every modern browser supports it to some extent. You're entitled to your opinion about this stuff, but know that my opinion has been hardened by many many years doing appsec for financial services companies. I would not doc a company for not having STS†, unless I was doing design/best practices review. I would doc anybody for not setting the secure flag on cookies for an HTTPS site. † (ie: if you ask me to doc stuff like STS and Clickjacking)
- MikeCapone 15y agoIs it possible for HN to use Google's SPDY protocol for better performance?
- grinich 15y agoIs this even supported by Chrome yet?
- bradly 15y agoYes. Many of Google's own sites like Gmail and Google Maps use SPDY in Chrome.
- calpaterson 15y agoI'd guess that for HN, protocol is not the bottleneck
- charlieok 15y agoGlad to see this trend. How about using https links in the RSS feeds, so that anyone coming in from their feedreader gets https by default?
- jorde 15y agoNice addition to HN. We also updated Chrome's Readable HN to work with HTTPS https://chrome.google.com/webstore/detail/jpnbjaechgbbpokepgmdkhgjfmkmjecn https://chrome.google.com/webstore/detail/jpnbjaechgbbpokepg... and if you would like to contribute https://github.com/jorde/readable-hn https://github.com/jorde/readable-hn
- pclark 15y agoWhy do people want https on Hacker News?
- tlrobinson 15y agoIMHO any site that has a login form should use HTTPS.
- jmatt 15y agoYep. For further explanation: http://codebutler.com/firesheep http://codebutler.com/firesheep
- nostromo 15y agoA lot of people on HN will use the same log in information they use on other sites. Some even have their email in their profiles. If someone logs in on a wifi hotspot, their password is easily visibile to others. And voilà, suddenly you have access to someone's email, facebook account, etc.
- deleted 15y ago[deleted]
- mike-cardwell 15y agoWhy do people not want https on Hacker news?