6 ms·

I find this post .. disturbing HTTPS is not only about "asking user for data" It is also: - preventing third party from spying on you - preventing third party

I find this post .. disturbing HTTPS is not only about "asking user for data" It is also: - preventing third party from spying on you - preventing third party from altering the content presented to the user Yes, yes, 20 years old websites do not have https Is running a 20 years old software a good idea, on the internet ? Of course not What is the point of this post ? I read the "why google really wants you to use https" and failed to find any sense in this Is this meaningless ?

forgotmypw17 3y ago
The privacy protection is a benefit, but it is balanced against accessibility, which is often more important, such as when trying to access important information on an older device.
- josephcsible 3y ago
  How old is the last device you know of that supports insecure HTTP but not HTTPS?
  - sam_lowry_ 3y ago
    My Mikrotik routers? My Openwrt routers? Lots of networking equipment works over HTTP only, still. I am actually really pissed off that I can not use Chromium password manager to save HTTP credentials for these devices.
    - Railander 3y ago
      > Lots of networking equipment works over HTTP only, still. MikroTik has supported https for a very very long time, though it comes disabled by default and even if it didn't it wouldn't work because it requires the user creating/importing a cert to use with it. At least the cert manager is quite intricate and they have a video (assuming the device has a valid WAN IP) on how to set it up with letsencrypt.
    - josephcsible 3y ago
      Both of those do support HTTPS: https://wiki.mikrotik.com/wiki/Manual:Webfig#Enabling_HTTPS https://wiki.mikrotik.com/wiki/Manual:Webfig#Enabling_HTTPS https://openwrt.org/docs/guide-user/luci/luci.secure https://openwrt.org/docs/guide-user/luci/luci.secure
      - sam_lowry_ 3y ago
        This is not the default, and frankly should not be.
  - bscphil 3y ago
    Usually supporting HTTPS is combined with requiring relatively recent versions of TLS and cipher suites, for security reasons. I've been in a position where I needed to use a computer from ~2007 or so briefly and found that I couldn't access a huge fraction of websites, despite the fact that the browser "supported" HTTPS.
    - pixl97 3y ago
      2007 on the modern internet... how fast was it compromised when you clicked the wrong link.
      - forgotmypw17 3y ago
        I regularly use old and older devices in my work, and they work fine as long as I don't go to random shady corners of the Web.
    - josephcsible 3y ago
      Firefox 27 runs on systems as old as Windows XP SP2, and it supports TLS 1.2 and the TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 and TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 cipher suites, which are still considered up-to-date and don't have any known vulnerabilities. If a computer from 2007 couldn't reach modern TLS sites, then it was just behind on updates that were available to it.
      - forgotmypw17 3y ago
        I've commented on this issue before, as I do a lot of testing in the accessibility space, so I'm just going to paste a previous comment: --- Only a few of the barriers presented by HTTPS: Clock sync would be a requirement for access. A recent device would be a requirement for access (not everyone can afford a new one). Site admin keeping up with certificate registration would be a requirement. Approval from the centralized certificate authority would be a requirement. Server's self domain name matching accessed domain name would be a requirement. These are all real scenarios where real people can be denied access to information that is crucial to them, up to the point of survival. Just a few of the reasons why all my websites still allow HTTP. HTTP is also way faster on slow connections. --- https://news.ycombinator.com/item?id=35800566 https://news.ycombinator.com/item?id=35800566
  - forgotmypw17 3y ago
    Not that old, if you take into account that older HTTPS versions are often not supported by the server. As little as 5 years, in my experience.
    - josephcsible 3y ago
      What 5-year-old device only supports older than TLS 1.2? (I assume that's what you meant by "older HTTPS versions".)
      - forgotmypw17 3y ago
        I understand your skepticism, but I'm coming from years of actual testing on many real-world devices that people use everyday and have no agency in upgrading for various reasons. As I mentioned in other comments, there are many possible areas where HTTPS can present a barrier to a user's access to your resource. Some of these I listed in another comment, which I copy below: --- Only a few of the barriers presented by HTTPS: Clock sync would be a requirement for access. A recent device would be a requirement for access (not everyone can afford a new one). Site admin keeping up with certificate registration would be a requirement. Approval from the centralized certificate authority would be a requirement. Server's self domain name matching accessed domain name would be a requirement. These are all real scenarios where real people can be denied access to information that is crucial to them, up to the point of survival. Just a few of the reasons why all my websites still allow HTTP. HTTP is also way faster on slow connections. --- https://news.ycombinator.com/item?id=35800566 https://news.ycombinator.com/item?id=35800566
        josephcsible 3y ago
        That doesn't answer what I asked at all, and I already rebutted those points in the other place you posted that: https://news.ycombinator.com/item?id=36597183 https://news.ycombinator.com/item?id=36597183
cutler 3y ago
Sites which don't handle user data do not need HTTPS.
- naikrovek 3y ago
  they do if they don't want a user's ISP to inject ads or modify content in transit. this does happen
  - bmacho 3y ago
    Just make it illegal (I think it already is on most of the world), problem solved.
    - naikrovek 3y ago
      you're right. making an activity illegal always stops it.
      - bmacho 3y ago
        I don't remember saying that, or anything close to it? If the law forbids ISPs to show ads or modify the content in any way, then they won't do it.
        pixl97 3y ago
        No what you stated was "take money out of politics" which is going to be far more difficult then the technical issues we're presented with. Why that statement, because any law to ban ISPs from doing this will be met with millions in political investment by said ISPs to prevent it. Since the average person doesn't care about this issue it's a losing proposition.
  - davewiner 3y ago
    i'm not going to re-do all the sites i did in the 90s, 00s, 10s. never going to happen.
bullen 3y ago
It's preventing the "wrong" third parties. Big companies and governmental branches have their own root certificates. To remove HTTP is the biggest mistake humans have made with the internet so far. But it will trigger a reaction that deprecates both companies and governments: http://radiomesh.org http://radiomesh.org Edit: Loving the down vote without comment and now the whole submission is flagged. Google really does not want HTTP around. They seem threatened by it?
- rednixion 3y ago
  Certificate transparency and the fact that Chrome only trusts leaf certificates that are in multiple log servers stop governments or rouge CA’s from doing a ssl mitm(or at least doing so quietly).
  - bullen 3y ago
    Well I would love to trust that, but if you go to the main police station in Stockholm Sweden and use their WiFi they proudly show you how they can read and modify your HTTPS traffic without your device so much flinching with their root cert.
    - bscphil 3y ago
      Upvoted simply because this claim is so astonishing. If you can back this up I implore you to provide as much technical information and proof as possible, because the PKI managers for the major browser vendors would certainly revoke certificates for this. https://groups.google.com/a/mozilla.org/g/dev-security-policy https://groups.google.com/a/mozilla.org/g/dev-security-polic...
      - CyberDildonics 3y ago
        This person has claimed that video games like starcraft won't be playable in the future due to power constraints and that 10 gigabit networking is impossible due to using too much power (no explanation for why it already exists). They have also claimed that 2012 atom CPUs are the pinnacle of CPU design so I wouldn't invest much into thinking you will get a real explanation.
davewiner 3y ago
did you read the part about how https doesn't protect us from the browser vendor, ie google? They tell us to worry about man-in-the-middle attacks that might modify content, but fail to mention that they can do it in the browser, even if you use a "secure" protocol. They are the one entity you must trust above all. No way around it.

forgotmypw17 3y ago

The privacy protection is a benefit, but it is balanced against accessibility, which is often more important, such as when trying to access important information on an older device.

josephcsible 3y ago
How old is the last device you know of that supports insecure HTTP but not HTTPS?
- sam_lowry_ 3y ago
  My Mikrotik routers? My Openwrt routers? Lots of networking equipment works over HTTP only, still. I am actually really pissed off that I can not use Chromium password manager to save HTTP credentials for these devices.
  - Railander 3y ago
    > Lots of networking equipment works over HTTP only, still. MikroTik has supported https for a very very long time, though it comes disabled by default and even if it didn't it wouldn't work because it requires the user creating/importing a cert to use with it. At least the cert manager is quite intricate and they have a video (assuming the device has a valid WAN IP) on how to set it up with letsencrypt.
  - josephcsible 3y ago
    Both of those do support HTTPS: https://wiki.mikrotik.com/wiki/Manual:Webfig#Enabling_HTTPS https://wiki.mikrotik.com/wiki/Manual:Webfig#Enabling_HTTPS https://openwrt.org/docs/guide-user/luci/luci.secure https://openwrt.org/docs/guide-user/luci/luci.secure
    - sam_lowry_ 3y ago
      This is not the default, and frankly should not be.
- bscphil 3y ago
  Usually supporting HTTPS is combined with requiring relatively recent versions of TLS and cipher suites, for security reasons. I've been in a position where I needed to use a computer from ~2007 or so briefly and found that I couldn't access a huge fraction of websites, despite the fact that the browser "supported" HTTPS.
  - pixl97 3y ago
    2007 on the modern internet... how fast was it compromised when you clicked the wrong link.
    - forgotmypw17 3y ago
      I regularly use old and older devices in my work, and they work fine as long as I don't go to random shady corners of the Web.
  - josephcsible 3y ago
    Firefox 27 runs on systems as old as Windows XP SP2, and it supports TLS 1.2 and the TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 and TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 cipher suites, which are still considered up-to-date and don't have any known vulnerabilities. If a computer from 2007 couldn't reach modern TLS sites, then it was just behind on updates that were available to it.
    - forgotmypw17 3y ago
      I've commented on this issue before, as I do a lot of testing in the accessibility space, so I'm just going to paste a previous comment: --- Only a few of the barriers presented by HTTPS: Clock sync would be a requirement for access. A recent device would be a requirement for access (not everyone can afford a new one). Site admin keeping up with certificate registration would be a requirement. Approval from the centralized certificate authority would be a requirement. Server's self domain name matching accessed domain name would be a requirement. These are all real scenarios where real people can be denied access to information that is crucial to them, up to the point of survival. Just a few of the reasons why all my websites still allow HTTP. HTTP is also way faster on slow connections. --- https://news.ycombinator.com/item?id=35800566 https://news.ycombinator.com/item?id=35800566
- forgotmypw17 3y ago
  Not that old, if you take into account that older HTTPS versions are often not supported by the server. As little as 5 years, in my experience.
  - josephcsible 3y ago
    What 5-year-old device only supports older than TLS 1.2? (I assume that's what you meant by "older HTTPS versions".)
    - forgotmypw17 3y ago
      I understand your skepticism, but I'm coming from years of actual testing on many real-world devices that people use everyday and have no agency in upgrading for various reasons. As I mentioned in other comments, there are many possible areas where HTTPS can present a barrier to a user's access to your resource. Some of these I listed in another comment, which I copy below: --- Only a few of the barriers presented by HTTPS: Clock sync would be a requirement for access. A recent device would be a requirement for access (not everyone can afford a new one). Site admin keeping up with certificate registration would be a requirement. Approval from the centralized certificate authority would be a requirement. Server's self domain name matching accessed domain name would be a requirement. These are all real scenarios where real people can be denied access to information that is crucial to them, up to the point of survival. Just a few of the reasons why all my websites still allow HTTP. HTTP is also way faster on slow connections. --- https://news.ycombinator.com/item?id=35800566 https://news.ycombinator.com/item?id=35800566
      - josephcsible 3y ago
        That doesn't answer what I asked at all, and I already rebutted those points in the other place you posted that: https://news.ycombinator.com/item?id=36597183 https://news.ycombinator.com/item?id=36597183

cutler 3y ago

Sites which don't handle user data do not need HTTPS.

naikrovek 3y ago
they do if they don't want a user's ISP to inject ads or modify content in transit. this does happen
- bmacho 3y ago
  Just make it illegal (I think it already is on most of the world), problem solved.
  - naikrovek 3y ago
    you're right. making an activity illegal always stops it.
    - bmacho 3y ago
      I don't remember saying that, or anything close to it? If the law forbids ISPs to show ads or modify the content in any way, then they won't do it.
      - pixl97 3y ago
        No what you stated was "take money out of politics" which is going to be far more difficult then the technical issues we're presented with. Why that statement, because any law to ban ISPs from doing this will be met with millions in political investment by said ISPs to prevent it. Since the average person doesn't care about this issue it's a losing proposition.
- davewiner 3y ago
  i'm not going to re-do all the sites i did in the 90s, 00s, 10s. never going to happen.

bullen 3y ago

It's preventing the "wrong" third parties. Big companies and governmental branches have their own root certificates. To remove HTTP is the biggest mistake humans have made with the internet so far. But it will trigger a reaction that deprecates both companies and governments: http://radiomesh.org http://radiomesh.org Edit: Loving the down vote without comment and now the whole submission is flagged. Google really does not want HTTP around. They seem threatened by it?

rednixion 3y ago
Certificate transparency and the fact that Chrome only trusts leaf certificates that are in multiple log servers stop governments or rouge CA’s from doing a ssl mitm(or at least doing so quietly).
- bullen 3y ago
  Well I would love to trust that, but if you go to the main police station in Stockholm Sweden and use their WiFi they proudly show you how they can read and modify your HTTPS traffic without your device so much flinching with their root cert.
  - bscphil 3y ago
    Upvoted simply because this claim is so astonishing. If you can back this up I implore you to provide as much technical information and proof as possible, because the PKI managers for the major browser vendors would certainly revoke certificates for this. https://groups.google.com/a/mozilla.org/g/dev-security-policy https://groups.google.com/a/mozilla.org/g/dev-security-polic...
    - CyberDildonics 3y ago
      This person has claimed that video games like starcraft won't be playable in the future due to power constraints and that 10 gigabit networking is impossible due to using too much power (no explanation for why it already exists). They have also claimed that 2012 atom CPUs are the pinnacle of CPU design so I wouldn't invest much into thinking you will get a real explanation.

davewiner 3y ago

did you read the part about how https doesn't protect us from the browser vendor, ie google? They tell us to worry about man-in-the-middle attacks that might modify content, but fail to mention that they can do it in the browser, even if you use a "secure" protocol. They are the one entity you must trust above all. No way around it.