12 ms·
Should All Web Traffic Be Encrypted?
- deleted 15y ago[deleted]
- latchkey 15y agoWe use CloudFlare. $20/month and you get your whole site encrypted plus all their other really cool features. It is a no brainer for those of us who can do it without violating contracts.
- ceejayoz 15y agoIt really isn't a no brainer. Passing our users' data through CloudFlare would violate our contracts with a number of clients. I'm also dubious about the privacy implications - they're presumably getting something out of those terabytes of free traffic they're handling.
- chrisaycock 15y agoThere was a discussion on HN a while back about why not all Internet traffic is encrypted: http://news.ycombinator.com/item?id=3115163 http://news.ycombinator.com/item?id=3115163
- pooriaazimi 15y ago> On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead. This is too good to be true.
- agl 15y agoI assure you that it's true. I haven't reprofiled in that much detail since but I suspect that the numbers look even better now. Partly because computers are faster and partly because of software improvements.
- match 15y agoIt largely depends up the nature of your web service. If you are running a user-interactive site theb i may buy it. However if you are offering a high-tps, high-throughput web service I assure you the costs of switching 100% of your users to SSL is not negligable and has a real impact on the customer experience.
- pooriaazimi 15y agoI still don't understand. 1% of what? Sure, if you're doing a lot of database read/writes for every HTTP request, then yes, that makes sense. I guess it that case, the actual HTTP would account for (say) 0.1% of CPU load – which makes HTTPS 10 times slower. I think we should compare HTTP and HTTPS connection creation/maintaining/dropping resource consumption relative to each other, not to the whole process that takes to process request, query databases, create page and send it to browser. I'm no expert in this matter, so I could be (and probably am) completely wrong. That assertion sounded counter-intuitive to everything I've ever heard, and as it is expressed a little vague, I doubted it.
- iRobot 15y agogmail security is really only good between gmail accounts and is definitely stored in plain text in the googlesphere use PGP if you need to guarantee email privacy.
- pnathan 15y ago> is definitely stored in plain text in the googlesphere have a source for that?
- JoshTriplett 15y agoBy definition, since Google can index email and mine it for keywords, they have access to the contents of it, which makes it isomorphic to plaintext.
- Andrex 15y agoThat's not the same thing though. Plain text is a security risk because users tend to reuse passwords. If it's hashed then that wouldn't be the case, even if they can mine it or whatever.
- mcherm 15y agoIf the content of the email were hshed then the recipient couldn't read it!
- dredmorbius 15y agoThey could if it were a reversible key-based hash. http://en.wikipedia.org/wiki/Cryptographic_hash_function http://en.wikipedia.org/wiki/Cryptographic_hash_function
- marshray 15y agoI believe you're thinking of a 'cipher'. Cryptographic hashes (even keyed ones) are expected to be one-way functions.
- ANH 15y agoSorry, off-topic, but as a fan it really bugs me that graphic halfway down appears taken without attribution from Hyperbole and a Half. http://hyperboleandahalf.blogspot.com/ http://hyperboleandahalf.blogspot.com/
- philwelch 15y agoIt's a popular image macro by now.
- jmitcheson 15y agoYou know it's become a huge internet meme right? http://www.google.com.au/search?q=x+all+the+things&oq=x+all+the+things http://www.google.com.au/search?q=x+all+the+things&oq=x+....
- ANH 15y agoMissed that one. Too busy reading Hacker N -- I mean, writing code. And the meme-ification only makes me feel slightly better about it. I mean, what's it cost Jeff to give a little credit?
- irahul 15y agoThere is a good chance Jeff doesn't know about the source, and generated using one of the meme generator sites.
- deleted 15y ago[deleted]
- richardw 15y agoHe likely made it here: http://www.quickmeme.com/All-The-Things/ http://www.quickmeme.com/All-The-Things/ I wouldn't have known where it originated from. It's possible/likely the source gave them permission to use it.
- ketralnis 15y ago
- revelation 15y agoYes, please, encrypt all the things, but absolutely don't use HTTPS to do it. See Daniel J. Bernsteins pet project CurveCP (http://curvecp.org/ http://curvecp.org/). He also had a talk on 27C3 (http://events.ccc.de/congress/2010/Fahrplan/events/4295.en.html http://events.ccc.de/congress/2010/Fahrplan/events/4295.en.h...).
- marshray 15y agoHow do you propose to use CurveCP to encrypt "all the" HTTP without involving HTTPS?
- patrickaljord 15y agoFunny that https://stackoverflow.com/ https://stackoverflow.com/ certificate is not valid.
- jacktoole1 15y agoTo be fair, Jeff Atwood recently left Stack Exchange (amicably, of course): http://www.codinghorror.com/blog/2012/02/farewell-stack-exchange.html http://www.codinghorror.com/blog/2012/02/farewell-stack-exch...
- jfoutz 15y agoI thought is last day was March 1? or... have i been working on this bug for way to long?
- deleted 15y ago[deleted]
- yuhong 15y agoFunny that this was written after Jeff Atwood left Stack Exchange.
- wisty 15y agoIronic, but there's virtually nothing private on SO.
- marshray 15y agoTraining users to click-through security warnings diminishes the security for all sites.
- mirkules 15y agoThat was actually my first thought after reading this. Chances are, people in public wifi spots will actively and aggressively ignore any and all warnings that get in the way of them getting their work done (I have witnessed this far too many times). However, Chrome surprised me the other day by not allowing me to continue on to a site that didn't have a valid certificate (I was MiTM myself using PAROS proxy to test something). In other words, we don't need stricter warnings, but the warnings must become errors for them to be noticed.
- zobzu 15y ago"we need to" hey, what about you go ahead and do it yourself? that's "simple"! you've to solve the certificate issues. Easy as pie. I'll be waiting.
- cookiecaper 15y agoIt's too bad this refers to SSL. There are sometimes good reasons not to use SSL, but there is rarely a good reason to send emails that contain any business, financial or security information over plaintext. Anyone who gets mails that amount to more than "Hey what's up man" should provide you with a public key for mail crypto. Also, it is very smart to use full-disk encryption and also encrypt sensitive info on that disk in a separate encrypted file (often preferably with something like TrueCrypt that allows plausible deniability via hidden volumes) if your computer is used for anything important. Think of the extent of damage that would have hit HBGary or any of the many other companies that have found themselves in a similar quagmire if they had employed some of that computer security knowledge to encrypt mail and required digital signatures before doing anything important (hint: the answer is 0). You may have a competitor hooked into your mail server for years before you know anything has happened, while you scratch your heads and wonder why they always beat you to the punch on new products and steal your big clients. You may have a hostile government agency after you for completely innocuous things, like downloading public domain research article. In this case, lots of encryption is going to buy your lawyers lots of time even if the judge eventually orders you to decrypt all of it; hopefully the real goods are hidden somewhere where they won't find them (like in a TC hidden volume, perhaps "in the cloud" in an encrypted file on Tahoe-LAFS over I2P).
- sp332 15y agoI use the EFF's Firefox addon called "HTTPS Everywhere". It has a list of websites that have HTTPS enabled, and whenever your browser is directed to the plain-HTTP version, it will go to the HTTPS version instead. https://www.eff.org/https-everywhere https://www.eff.org/https-everywhere A useful (but tbh kinda annoying) companion addon is the HTTPS Finder. It checks to see if the website you're currently browsing also has an HTTPS version, and will add a rule to the HTTPS Everywhere addon. (It also has a "whitelist" of sites that this breaks.) https://addons.mozilla.org/en-US/firefox/addon/https-finder https://addons.mozilla.org/en-US/firefox/addon/https-finder
- kevin_jacobs 15y agoHTTPS Finder dev here - If you go into settings you can turn off the auto-redirect to HTTPS or the actual drop down alerts (or both). Then you can go into Preferences > Advanced after some browsing, and you'll see a list of all the good sites found. You can create HTTPS Everywhere rules directly from there, without ever being annoyed during your normal browsing.
- AgentConundrum 15y agoThanks for mentioning this. I've been using HTTPS Everywhere for a while now, but it's been almost entirely a vanilla install since I got it. The only exception so far has been HN itself, and only because someone put the new rule in a comment. I then had to use Google to find out how to actually install the rule, as it was pretty non-obvious to me.
- AgentConundrum 15y agoIt seems I've been downvoted, and I think I know why. I can't edit my original comment so a reply will have to do. My comment was meant to be a sincere thanks for mentioning the HTTPS Finder extension. Reading my comment now, without that clarification, I can understand how it could read as a criticism of the HTTPS Everywhere extension instead. That was not my intention. I merely wanted to express my thanks for making me aware of a complimentary extension which adds useful functionality to an extension I already use. If the downvote was for another reason, please let me know what was the reason for it so I can try to avoid committing the same error in the future.
- drivebyacct2 15y agoThere was an article posted a while back that seems like it might be relevant here (especially with the doubting of SSL being feasible to deploy for everyone). It discussed how many sites use OpenSSL improperly or in a poorly configured way that causes it to be more expensive than it needs to be. I hate doing this, but I also have been looking for the link for a while with no success.
- brown9-2 15y agoWhat's with the submission of the title here? Would be less meme-y if the blog article title was used.
- asdfaoeu 15y agoFor content that is already public but needs to be protected from modification like images and scripts couldn't it be hashed and the hash just sent with the page your viewing. Then the browser could download extra assets from an insecure source like a proxy or cdn and know that it hasn't been modified?
- wmf 15y agoSo then the browsers have to implement two security systems.
- alexchamberlain 15y agoNot entirely, as SSL already includes a hash. That said, I don't agree with doing it. However, I do believe that we should investigate ways of authenticating larger downloads automatically.
- TomGullen 15y agoAdding SSL to a site sounds easy but it's very difficult in some instances. Take for example a forum, we can force everyone on HTTPS quite easily but as soon as someone hotlinks an image in a post that's not HTTPS it'll throw security warnings up which are (in my opinion) overly dramatic and are very unfriendly to the user experience. User submitted content and HTTPS can be a pain to get right, and on some platforms like common bb software it's basically so time consuming to modify it's just not worth doing. SO solves this by using imgur as a proxy, a lot of sites don't have that luxury unfortunately or even the technical expertise to implement something similar. This is also a bit wobbly on the old copyright laws as well.
- TomGullen 15y agoLesser known HTTP feature that I love, instead of linking to resources like follows: <link rel="shortcut icon" href="http://static4.scirra.net/images/favicon.ico http://static4.scirra.net/images/favicon.ico /> You should link as follows: <link rel="shortcut icon" href="//static4.scirra.net/images/favicon.ico" /> The double forward slash will select the current protocol the page is being viewed on which means no security errors if you're switching between http/https!
- ohashi 15y agoThat is a neat trick, does it work on all browsers?
- dm_mongodb 15y agoi think so yes
- subleq 15y agoYep, I've tested it down to IE6.
- tghw 15y agoIt does, although IE 7 (and possibly 6) have a bug where they will double request the resource. But, honestly, if they're on IE6 or IE7, the web isn't fast for them anyways.
- speleding 15y agoThe double request on IE only happens on stylesheets, all other requests (including javascript) are fine.
- nzmsv 15y agoNitpicking here, but this would be a URI rather than HTTP feature. It is described in RFC2396 and is just part of how relative URIs work.
- gurkendoktor 15y ago
- SoftwareMaven 15y agoJust Tuesaday, I sent an email around the company discussing SSL vulnerabilities, how they impact our product, and ways we can mitigate that. I've pulled out the parts specific to our product, but the rest may be interesting. I would love feedback on things I may have missed. FWIW, it doesn't instill great confidence in SSL, but it isn't completely horrible. ------------------------ 1. It is possible to pretend to be any site you want if you 1) find a sleezy CA (and they exist aplenty) or get the government involved and 2) can get between your browser and your final destination (like, for example, a wifi hotspot). There will be no way (reasonable) way to tell you aren't connected to whom you think you are. http://www.wired.com/threatlevel/2010/03/packet-forensics/ http://www.wired.com/threatlevel/2010/03/packet-forensics/ This could be addressed using http://convergence.io/ http://convergence.io/ 2. Way easier, but leaving some tell-tale signs you can find is to simply put yourself between your victim's browser and his server and convert all the links that come back to be insecure links that go through you. You then encrypt them as you pass them on to their final destination, while being able to see everything that happens. This is trivial to set up, but can be gotten around simply by using bookmarks that specify HTTPS. http://www.thoughtcrime.org/software/sslstrip/ http://www.thoughtcrime.org/software/sslstrip/ This won't go away until everybody is using 100% SSL and HTTP (unencrypted web traffic) is turned off in browsers. DOWNLOADING AND INSTALLING ANYTHING OVER AN UNSECURED NETWORK IS ALWAYS A BAD IDEA. 3. For the very determined, it is possible to determine the symmetric key a particular SSL session is using if you have some luck, some skill, and some time (about 30 minutes). http://www.schneier.com/blog/archives/2011/09/man-in-the-midd_4.html http://www.schneier.com/blog/archives/2011/09/man-in-the-mid... This requires a protocol change to SSL. We've known about (theoretical) vulnerabilities for 10 years, yet most sites still run old versions of SSL. Given how slowly people like banks update infrastructure technology, I don't see this one going away for a long time. 4. If a site is improperly configured, it may allow an attacker to gain access to the cookie representing your secure session by making an insecure request. This is another class of vulnerabilities made possible by using untrusted networks. The misconfiguration allows the browser to send your (supposedly) secure cookies in an unsecured request simply by making any request (typically done by inserting JavaScript into an unsecured page you are browsing). It is possible to mark cookies as "secure only", but services will choose not do that so you don't lose your session if you type http://example.com http://example.com instead of https://example.com https://example.com. http://fscked.org/blog/cookiemonster-core-logic-configuration-and-readmes http://fscked.org/blog/cookiemonster-core-logic-configuratio...
- lee 15y agoWhen I'm on some kind of public wifi, I always surf through an SSH proxy so that my traffic is encrypted. That helps if you're hitting up sites that don't have https.
- harryh 15y agoOne item that this (excellent) blog post does not adress is what to do about referer information which is generally not passed along when clicking on links on sites being browsed over SSL. In order to "get credit" for all of the traffic that they send everywhere twitter had to develop a fairly elaborate system of redirections (built into t.co) to make sure that clicks from twitter.com ended up being sent out to the rest of the web with referer information. It would be a real shame if everyone in the world had to develop a similar process. Part of me thinks that browsers should start sending referer information even when you click on links for SSL sites, though this change would bring with it other problems. It is not at all obvious (to me at least) what that best thing to do here is.
- mkjones 15y agoYeah, this is a bit of a pain. We have to something similar for facebook (https://www.facebook.com/note.php?note_id=10150492832835766 https://www.facebook.com/note.php?note_id=10150492832835766). There's talk of a meta referrer tag (http://wiki.whatwg.org/wiki/Meta_referrer http://wiki.whatwg.org/wiki/Meta_referrer) that would allow overriding this behavior and making things a lot simpler, but afaik it's not implemented in any of the major browsers.
- wladimir 15y agoWhen going from https to https site, referer information is usually being sent, at least with modern browsers. So if the whole web goes encrypted (yay), the issue is solved.
- harryh 15y agoReally? That's....very strange. The rules for this sort of thing seem so arbitrary.
- wladimir 15y agoIt makes a little bit of sense. When you come from a https site, you don't want to leak referrer (and thus which part of which site you were visiting) over the unencrypted internet. Though in my eyes sending referrers always has been questionable "insecure by default" behavior, as the internal structure of one site is leaked to another. With hindsight, maybe it should have been restricted to the domain name.
- eloisius 15y agoScumbag CodingHorror Says encrypt all the things... isn't encrypted.
- lukifer 15y agoDid you notice that he was referring specifically to sites with accounts? There's little point in encrypting public data, especially if tracking cookies aren't involved.
- dhx 15y agoYes: using IPv6 IPsec everywhere, a web-of-trust model and a distributed method for key exchange (DHT?). I may be dreaming.
- jpalomaki 15y agoWouldn't it provide good additional security if there would be a possibility to define those HTTPS Pins [1] in the DNS, in TXT recods? This would be fairly lightweight way for me to say which CA(s) I use for a particular domain. [1] http://www.imperialviolet.org/2011/05/04/pinning.html http://www.imperialviolet.org/2011/05/04/pinning.html
- jpalomaki 15y agoWith second thought this does not make sense. False certificates would be only problem in man-in-the-middle attacks of if the attacker can alter information in dns. In both cases the attacker could also fake the information about valid ca's.
- strags 15y agoSounds at first like an admirable concept, but unfortunately would be incredibly problematic. What about the case where you're virtual-hosting many sites on one IP address? Since the SSL handshake occurs prior to any HTTP data being sent, and the browser will reject a server-certificate whose hostname does not match, you're normally restricted to one HTTPS domain per IP address. I gather there are TLS extensions to suppport SSL vhosts, but I don't know how widespread they are. There are also methods of including more than one hostname per certificate, but I'm assuming that when you purchase a SSL cert from a registrar, you're going to be restricted to one host.
- mattsoldo 15y agoYes... why would any website that values privacy and security not use HTTPS for everything? We've been doing that from day one on https://postgres.heroku.com https://postgres.heroku.com.